The header only shows how they were authenticated.  They need to disable the antirelayd service (yes I know .. the naming..) in the Service Manager to disable popb4smtp