For anyone else looking at this, for the obvious reason, it seems you will continue to see the Amavis "Open relay?" log entries -- even when Global and Server Webmail MTA Hostnames settings are "localhost" or the simply same as instructed above -- when mail is sent by an sasl authenticated sender instead of the Web interface.

Ie: Amavis doesn't seem to know about the permit_sasl_authenticated smtpd_recipient_restrictions.