OK, I'm sold; I'll use SMTP-AUTH instead of POP-before-SMTP. I can authenticate from inside or outside the network, using SMTP-AUTH in either PLAIN or LOGIN mode. CRAM-MD5 is apparently not implemented (yet).
I can only relay when I connect from inside the network. Attempting to relay from outside the network gives me the error "553 sorry, that domain isn't in my list of allowed rcpthosts." I am not using a SQL db for the backend. Should I be seeing a file called open-smtp? It doesn't exist. How do I get this thing to allow me to relay from my dynamic IP address once I've authenticated with SMTP-AUTH? !DSPAM:4af9cd4732712061415888!