Are you running SMTP auth? If so it is possible that you forgot the hostname param in the qmail-smtpd startup script (very common). If that is the case, then anyone can authenticate using any username and password. Spammers know and exploit this issue.
