Recently cpanel has added a feature called SMTP Restrictions:
" You may want to prevent users from bypassing your mail server to send mail. This is common practice for spammers.
This feature allows you to configure your server so that the mail transport agent (MTA), Mailman mailing list software, and root user are the only accounts able to connect to remote SMTP servers. "
Please add this good feature to virtualmin too.