I just tried your suggestion and it worked just fine. The spam problem isn't an issue anymore.
Now, for the first problem (spoofed addresses) I tried to tag port 25 and rejected every e-mail from the table recipients, but it seems that there is no way to filter the sender addresses from a list. Is it possible to accept e-mails from any domain but not from the local users? Thanks.
