Allow Relay in Settings - Protocol - SMTP In is for relaying messages off the SmarterMail server. We have always set it to Nobody so only sent messages that authenticate via SMTP can relay.

When enabling Require Smtp Authentication for a SmarterMail domain under Domain - Configuration - Security, messages sent from the domain are always required to authenticate via SMTP. This helps prevent spoofing by preventing a non-SmarterMail user from sending a message from the domain to a user in the domain or another user on the SmarterMail server. If this setting is disabled, then messages could be delivered to your SmarterMail server from this domain without providing a password.

The domain setting "Require Smtp Authentication" goes one step further by requiring SMTP Auth for the domain, even when sending messages to local SmarterMail mailboxes.