I have configured postfix on my server.

telnet mydomain.com 25
helo validdomain.com
mail from: validaddress@validdomain.com
rcpt to: validuser@mydomain.com
data
From: validaddress@validdomain.com
To: validuser@mydomain.com
CC: user1@domain1.com,user2@domain2.com
Subject: Testing postfix
Message body

When I run this test, as expected, the email is delivered to validuser.
However, postfix also delivers it to user1 and user2 despite the fact that the sender does not belong to my domain.
I have implemented client, helo and recipient restrictions as below.
How do I prevent the malicious use of CC as described here?
Thank you

Snap of main.cf
-------------------
smtpd_client_restrictions = permit_mynetworks,
reject_invalid_hostname,
reject_rbl_client zen.spamhaus.org,
reject_unknown_client,
permit

smtpd_helo_restrictions = permit_mynetworks,
check_helo_access hash:/etc/postfix/helo_access,
reject_unauth_pipelining,
reject_non_fqdn_hostname,
reject_invalid_hostname,
warn_if_reject reject_unknown_hostname,
permit

smtpd_recipient_restrictions = reject_non_fqdn_sender,
reject_non_fqdn_recipient,
reject_non_fqdn_hostname,
reject_invalid_hostname,
permit_mynetworks,
reject_unauth_pipelining,
reject_unknown_sender_domain,
reject_unknown_recipient_domain,
reject_unauth_destination,
reject_unknown_client,
permit

smtpd_sender_restrictions = permit_mynetworks,
reject_non_fqdn_sender,
reject_unknown_sender_domain,
reject_unknown_address

With all the rules the first matching one wins. So often it's coded to permit certain accesses, and the final rule is to reject.