They can’t, unless qmail has been configured to know they control mail for domain.tld. The admin configuration mechanism for this (control/virtualdomains) is simple and powerful.
Sorry I'm confused. If your mail server is setup for control of a domain (e.g. domain.tld), then what stops someone from putting [email protected] in this .qmail file?
People can put whatever they want in their own .qmail files. That doesn't affect anything unless qmail believes those .qmail files are relevant to what it's delivering. A user controls .qmail files for a domain if and only if an admin has configured qmail to delegate that domain to that user.
Ahh I see. So it's a per domain thing, and you can't restrict more granularly. That's a shame.
I'm tempted to start auto-allowing new aliases and just having a list of names that can't be used (postmaster, webmaster) etc, that some services use for domain ownership verification.
As an aside I do hope qmail offers similar limiting abilities. It wouldn't be great if a user could make themselves receive [email protected] emails!