Sending mails from external server via internal Exchange

Are the two users part of a shared mailbox, and sending it out as another user that is part of that share?  They shouldn't be able to send as another user if your security is set up correctly.  AD environment?

It is an AD environment.
The two mailboxes are shared mailboxes and the users are the (by default) disabled Active Directory users/user objects of the mailboxes itself.

That's a permission issue, not a UTM issue.  If they have rights to send in Exchange from a shared box, they can do it.  

Even is the users are disabled, they are still part of the share (stupid, yes I know, but Microsoft...).  You should remove them from the shared mailbox, or at the very least change the permissions so that they can read only and not send.

But these are default users which are added by the Exchange automatically if I add a shared mailbox via Exchange ECP.
By default they are disabled.
Example: If my shared mailbox is called team1@mymail.com there is automatically a disabled user which is called team1.

I enabled them and gave them a password to use the accounts for sending mails directly from it.

You should still be able to actually remove the mailbox user that it was created for from that mailbox to prevent that very thing.  

You should still be able to actually remove the mailbox user that it was created for from that mailbox to prevent that very thing.