Spammers able to spoof local addresses

[GrizzlyAdams]

I keep recieving spam sent to hosted accounts, spoofed from non-existant hosted addresses:

From: <staff@xxxxxxxx.net>
To: <sales@xxxxxxxx.net>


It looks as though the To: is checked for local delivery before the From: is checked for local senders...
Is there a way to switch the behavior so any messages claiming to be sent from a local address have to authenticate, even when sending to another local address?


Also, I have strict SPF records set, which only allow my server to relay for the domain. I don't see anything from spam assassin about the SPF failure, but I see plenty of hits from rbl lists on the messages.


- Grizzly

[SMG]

I've been seeing this a LOT lately. This is the only post I could find about this, does anyone know much about it? Basically seeing a lot of instances where someone emails someone@localdomain.com using from/return path/etc as someone@localdomain.com (identical address, local) and it gets through anyway. Shouldn't this require some sort of auth?