No details, but suffice to say getting changes in firewall policy on our end is nigh impossible, and a problem as well on the other side.
OTOH, if somebody can point me to an easy "accept mail only from localhost, and forward to single destination" script, I'll try that.