It's true that if your Relay Restrictions are set to Only the List Below, which is blank, and you have checked, Allow authenticated computers to relay, then your server is considered Closed for Relay.
But there are other ways your Server can be configured to become Open Relay.
For example, if you have a SMTP connector with an address space of *, and this check box is checked at the bottom: "Allow messages to be relayed to these domains". Then this will make the server an Open Relay.
Other common method Spammers / hackers use are enabled guest accounts, and crack the password for Administrator account.
Once the mail is accepted by one server, it can relay to other servers. Also, if one server (e.g, SMTP gateway) becomes Open Relay, it can relay mail to internal servers if there are internal recipients (just as an example). Or it can relay to other SMTP gateways, if it sees it as a better route.
(thanks to Mohammad Nadeem for this info)