Hmmm.  This makes a bit of a presumption.   I've actually been switching my own servers to using AUTH for their outbound instead of allowing relaying by IP/CIDR.