Good thing that I still have my old server available. I can see different postfix configs in some places. In my case, the culprit with new Zentyal server (3.4), was the following line:
smtpd_sender_restrictions=reject_authenticated_sender_login_mismatch
I really wonder, why such gotchas are being put into each possible update. Ditto Apache included in latest version - your websites will not work, as order allow, deny directives were replaced by Require all granted directive.
Not a Zentyal thing, but I would expect it being mentioned in the docs ...