Prevent 'on behalf of' showing internal but really from external domain

[Justin Edmands]

We have seen a few messages that were allowed to be sent "on be half of" a user 
within our network. The external users domain was able to send through our 
relay and sort of spoof the user. Any way to use spamassassin to prevent this 
sort of this?