Reject spam from my own domain

We have whitelisted our domain, but now we have spam coming from users that claim they're in our domain.

What's the best way to fight it?