My postfix can be set as SMTP server on any email client, on port 25, no auth, to successfully deliver e-mail to any domain listed in $relay_domains. This is bad, and can be easily used to send spam bypassing any restriction set to the submission port (587).
This is expected behavior. For example: Gmail server must connect to port 25 without auth to deliver email from @gmail.com to your
I try to explain myself better with an example. If I set up my Thunderbird to use my email server as SMTP with no auth and port 25, I can send email to a known address belonging to my email server. Is this expected behavior?
Yes. Basically Gmail (in my example) and Thunderbird (in your example) both act as a mail client to send email TO your
The only concern is if you accept email from outside your
mynetwork (without auth) and then deliver it to domain outside
relay_domains. In that case, you have successfully created one free open relay.