OK, if you're using a local MTA (eg sendmail, postfix, exim whatever) as you've realised, you need to control who can relay through it.
From what you've said it sounds like you only need the server to be able to relay.
I'm used to sendmail, so here goes:
sendmail in it's basic config isn't normally setup to use passwords, it uses a file called access.db (often in /etc/mail) to control relaying (or somethimes relay-domain).
I use access.db
This file is a hash file normally created from a file called 'access', to allow locahost host to relay and only localhost, you simply add '127.0.0.1 RELAY' to this access file, then recreate the access.db (often the command is 'make access'

.
and 'tis done.
The exact process will depend on your OS. What OS are you using.
www.plymouthcricketclub.com - providing cricket for all ages in the Plymouth area.