OK, this is a problem with my understanding. I couldn't find anything on forum for this.
I've got external authentication working.
To add myself I've done:
ca firstname.lastname@example.org '' zimbraMailCanonicalAddress email@example.com
and I can login.
Sending email via a telnet session to port 25 works for firstname.lastname@example.org. When I try email@example.com I get "Relay access denied".
Now all of our user details are in LDAP and it's working with postfix, courier-imap, etc. I assume there is a mapping somewhere that I need to set that allows mail to be recieved by "firstname.lastname@example.org".
So what has my huberis caused me to miss?