Reject inbound mail from local domain

[hede]

Hi list, 

with email it's possible to have anything as the senders address. Even any valid local mail address is allowed to come in via external mail servers.

For example if I have two users: first_user at example.com and second_user at example.com. Anyone can send a mail with "from:" header "first_user at example.com" from anywhere in the world to "second_user at example.com" and kolab accepts this, even if postfix should know that mails from its local domain (i.e example.com in this example) _must_ come from authorised users only (or from internal processes at least) and not via some port 25 smtpd. 

Whats the best way to filter those incoming mails? Spamassasin, header_checks, check_sender_access or something else?

I would like to mark all those mails as spam or forward all of them to an admin user. 

The thing is: If an internal user get's a mail from first_user at example.com (where example.com stands for my own internal domain) it should be reliable that it was sent by the local user who has first_user at example.com as it's mail address or mail alias. 

Regards
hede