Currently the mail filtering API is not very well documented, but it's there. Courier is a closed mail relay by default. Courier cannot be accidentally configured as a completely open relay. A deliberate feat of stupidity is required for that to happen. Courier also refuses to accept any mail with a return address in a domain with broken MX records.
Courier can automatically blacklist domains whose mail servers reject delivery status notifications.
Header rewriting Courier will rewrite headers and MIME-ify messages whenever appropriate. Header rewriting logic is hardcoded in C, there is no header rewriting language as in sendmail. An interpreted language imposes a drastic speed penalty. The rewriting library is fairly simple, and the the standard rewriting rules will do for most situations. Courier rejects messages with badly-formed or missing MIME headers.