Using SMTP I can send emails through bluehost (using email addresses I've created using my domain), and a password is absolutely not required. I'm using port 25, no SSL/TLS, and they send and get received just fine. I swear there used to be some sort of authentication involved, but that doesn't seem to be the case.

Is there a gap in my understanding about how email should function?

Thanks in advance for any responses!