LMTP doesn't require authentication

Question

Why does LMTP send emails without authentication?

Answer

SMTP uses authentication, but LMTP doesn't. Sending messages to a local address will use LMTP instead of SMTP. LMTP is the local delivery agent that saves the received emails to a user's inbox. There is no need for SMTP authentication at this stage. Sender authentication happens at the submission stage. During the delivery stage, the email is already trusted for local storage.

Please see the How to Prevent Email Abuse documentation to protect the server and users from receiving and sending spam.