Sounds like you are running an open relay. (Probably by accident.)
Since you didn't specify what mail server software you're using, it's impossible to give specific advice on how to secure it, though Google will turn up this information.
As for your Windows Firewall, you just need to add an output rule blocking port 25 (I don't have a Windows 7 box handy or I'd make you some nice screenshots). You still should secure the mail server, though, since the firewall might fail, somebody might delete the rule, you may get a virus, etc.
For a high-level overview of what you should do to secure a mail server, see this question on Server Fault: Fighting Spam - What can I do as an: Email Administrator, Domain Owner, or User?