exchange

we’ve installed exchange 5.5. We’ve set up our internal messaging system for x.400 to restrict outside access. we seem to be doing something wrong as our users manage to send and receive emails through the internet. what are we doing wrong? would appreciate any comments.