Nathan Fowler's pop-before-smtp simply watches for POP3 connections. When a POP3 connection is made, that IP address is given access to the SMTP server for a few minutes. It works with smtpd_check_rules, so it only works on 5.1.2 and earlier. It's not 100% secure, but it allows valid users to use the SMTP server externally, without opening it up completely.
Damien Curtain's SASL contrib actually adds user authentication and optionally SSL encryption to the mailfront SMTP connections. The user has to login with their SME username and password to access the SMTP server from outside the LAN. This works on 5.5 and 5.6.