Hi
Currently only illegitimate emails like user@192.168.3.3 are restricted by postfix. A registered user can send email from any non registered domain too . So if the domain Yunohost.org or gmail.com is not registered with my server, I still can send email from sender address from these domains. eg user@yunohost.org and user@gmail.com.
There should be sender envelop restriction to registered domains only.
Future there should be username and alias check with the From address of the email, so that the spaming from the server can be checked and stopped.