On the web interface of the MSL box go in to E-mail Settings and make sure that SMTP email injection restrictions is set to Local Host Only. If it is set to either of the other two options, then it means that the box is open as a relay to either the local network, or to who ever is able to connect to it, which if it is a MBG server could mean that it is open to anyone on the internet to relay through.