This changes the version number that reported by the sendmail daemon. Telnet to port 25 and send some generated mail. This will show you if anything is open. OpenBSD comes with netcat, which allows you to do neat things. Make sure that you are using tcpwrappers as well.
Happy firewalls have lots of logs.
This reduces the risk of some suid program's unknown buffer overflow taking over your system. You can't un-suid sendmail if it is running as a daemon, as it needs to be root to bind to a priviledged port. I know this is pretty spartan documentation. I just teach Unix Systems Administration and am a systems contractor.