Always relay messages sent by users forging to be from the same domain

[meow]

On my sendmail server, I have setup to allow relay_hosts_only and on
the access file, I have specified to restrict just certain IP
addresses to relay to the mail server.

Here, I assume that my domain is @abc.com. I observed the following
when I am connecting from an IP address which should not be allowed to
relay to the mail server.

1) When I set in the From field as us...@xyz.com and I send to someone
in the domain @abc.com, the email cannot be relayed and sent out.
This is within my expectation.

2) When I set in the From field as us...@abc.com and I send to someone
in the domain @abc.com, the email got relayed and sent out. This is
not what I expect.

I do not know how I can avoid case 2. Please advise me what I have
done wrong.