Sounds right to me, both examples.

Does that explain the situation with your other location with hotmail?

All (most) ISP's have to authenticate their outgoing mail to verify it is a REAL user connected to them.  They do it by ip address (verify it is within their domain) and by userid and password.  Not all do it by ip address, but that is the more restrictive.

It used to be that you could put david@whitehouse.gov (and the whitehouse servers) and send emails to anyone as if you worked for the whitehouse.  Pretty scarry!