Ok I recently set up QMAIL on Slackware 9.1 using the qmailrocks.org walkthrough. When I scan my pc for open relays I run into scans using username%domain@mydomain.com ,username@domain@mydomain.com,
username%domain, "username@domain"@mydomain.com. How do you block that kinda relaying from people?

Allow relaying by ip address

http://www.palomine.net/qmail/selectiverelay.html

I do..this is a copy of my tcp.smtp
# No Qmail-Scanner at all for mail from 127.0.0.1
127.:allow,RELAYCLIENT="",RBLSMTPD="",QMAILQUEUE="/var/qmail/bin/qmail-queue.pl"
# Use Qmail-Scanner without SpamAssassin on any mail from the local network
# [it triggers SpamAssassin via the presence of the RELAYCLIENT var]
200.:allow,RELAYCLIENT="",RBLSMTPD="",QMAILQUEUE="/var/qmail/bin/qmail-scanner-queue.pl"
#
# Use Qmail-Scanner with SpamAssassin on any mail from the rest of the world
:allow,QMAILQUEUE="/var/qmail/bin/qmail-scanner-queue.pl"

Did you check to see if those messages were actually relayed to a wrong domain, though? Just because qmail accepts the message with an address in that format doesn't mean it will get delivered to where the script thinks it will go.

The company I work for makes an e-mail security product and every once in a while a prospective customer will tell us that it's an open relay, but then we ask if they confirmed that the e-mail was delivered to the relay domain and they admit it wasn't. Our software silently rewrites addresses to make sense, rather than relaying them. I suspect your Qmail server does the same.

To properly test, use a second e-mail account that you have access to (your ISP, or something like that) so your test looks like ispuser%ispdomain@mydomain.com, etc... Then check your ISP e-mail account and see if you really got the messages.