Um, I think you should review the current plugin and see what isn't there: (https://github.com/baudehlo/Haraka/blob/master/plugins/rcpt_to.in_host_list.js).  It doesn't check relaying at all. At present, the use case you're protecting isn't possible with this plugin. 

What this change does is actually open that that door, carefully.