I just noticed a bunch of warnings like the following in /var/log/zimbra.log:

Apr 10 13:22:12 zimbra amavis[31557]: (31557-05) Open relay? Nonlocal recips but not originating: recipient_name@recipient_domain.com
Earlier I'd also noticed in the Admin GUI that Configuration > Servers > servername >MTA > Web Mail MTA Hostnames was set to the fully qualified domain name of Zimbra, but there was a button to "reset to COS".

Since I don't remember seeing that before, I suspected it had been inadvertently set by another admin, or somehow created during an upgrade. (Our most recent upgrade was 5.0.20 to 6.0.5.) So I tested sending mail by various means (ZWC, IMAP client, ActiveSync) to a nonlocal address to make sure it triggered the warning, then I set the value to the one found under Global Settings > MTA, which is simply "localhost". This produced a cautionary popup in the Admin GUI:
Warning: this will cause the web server to send outbound mail to localhost. You should do this only if an MTA is installed and running on localhost! Do you want to proceed with this change?
I ignored it--I could change it back if something got screwed up.

Sure enough, the amavis warning didn't reappear in zimbra.log and everything else seems to be working properly.

So I'm posting to see if anyone has any advice on this--which is the proper setting for a single-server ZCS config? And also to compare notes with anyone else who's seen this amavis warning.