a1@example.com:       user1@mydomain.com
a2@other.example.com: user1@mydomain.com
a3@example.com: a4@example.com
a4@example.com:       user1@mydomain.com

a5@example.com:       user2@mydomain.com

accept
    authenticated = *
    verify = sender
    logwrite = authenticated user '$authenticated_id' sending as '$sender_address' which
        is '$sender_address_data' or '$address_data', if error: '$sender_verify_failure'

authenticated user 'user1' sending as 'a5@example.com' which is '' or '', if error: ''

real_local:
  driver              = accept
  domains             = +local_domains
  local_part_prefix   = real-
  check_local_user
  transport           = LOCAL_DELIVERY
  # Set this so acl can use it
  address_data        = ${local_part}

acl_smtp_mail = acl_check_sender_vs_auth

# Ensure that the MAIL FROM: address matches what the authenticated
# user is, if authentiation is used
acl_check_sender_vs_auth:
    accept
       authenticated = *
       # verify MUST be above condition to resolve $sender_address_data
       verify = sender
       condition = ${if eqi{$authenticated_id}{$sender_address_data}{yes}{no}}
       endpass
       logwrite = AUTH OK - authenticated user '$authenticated_id' sending email from '$sender_address', which belongs to '$sender_address_data'

    deny
       authenticated = *
       # verify MUST be above condition to resolve $sender_address_data
       verify = sender
       !condition = ${if eqi{$authenticated_id}{$sender_address_data}{yes}{no}}
       message = User '$authenticated_id' tried to send mail from '$sender_address', but that email address belongs to someone else
       logwrite = AUTH ERROR - authenticated user '$authenticated_id' tried sending from '$sender_address', but that address belongs to '$sender_address_data'

    accept