People can put whatever they want in their own .qmail files. That doesn't affect anything unless qmail believes those .qmail files are relevant to what it's delivering. A user controls .qmail files for a domain if and only if an admin has configured qmail to delegate that domain to that user.

Ahh I see. So it's a per domain thing, and you can't restrict more granularly. That's a shame.

I haven't experienced a need for more granular restrictions. Can you give an example of a problem it would solve?