I am running a postfix server. When I test open relay through some of the open relay web pages on the internet it reports "No open relay". But, I can telnet into the box and send mail to and from anywhere that I please.

There is no security in place, like POP-BEFORE-SEND or anything like that. So how can I tell if this thing is open relay or not?

Also, I have people with mail clients like outlook or are able to connect to postfix and send mail to anyone....

I don't get it. It seems like open relay (which I do not want), but, open relay web programs are saying no.... What gives.

I think it is safe to say it is not an open relay. If it was, spammers would have discovered it within minutes and you'de be getting angry calls from your ISP's abuse department within the hour.

In a normal setup, Postfix is configured to accept mail for relay only from specified IP addresses (your network). This is set in main.cf (/etc/postfix/main.cf on my server):
mynetworks = 192.168.1.0/24, 127.0.0.0/8