hi. we are using qmail as our MTA. Now the users are using outlook and web client. There is one important thing that i like to share with people here and request from the experts to suggest some solution. when using outlook you can just give someone's else name who has got an account in the same domain having same qmail server running and you will be receiving and sending on the behalf of that person rather you will be using his/her account. This is a great flaw. Now if someone is aware of that and knows how to correct it plz share his/her experience.

It sounds like the authentication is based upon network and not on a per user basis and the users are within the network OR you are inadvertently running an open relay. Typically one would use SASL authentication against a user database with passwords. I don't know much about qmail's authentication mechanisms, but I do know that qmail is old and has been unsupported for a long time. Unless there is an easy solution to this problem, I would recommend a more current MTA.

I can understand that you will be sending email using that person's account. I would be surprised if you could receive that person's email without their password.

Email applications can use smtp auth to enforce the use of a password when sending email. Go to http://www.qmail.org/top.html and do a search for smtp auth. You will see some options.

I would recommend setting up a test server and getting smtp auth to work on it first. You should only modify your production server when you have everything working properly.