I found two mailer daemons from my mailing list. Not good. :)

Here's a theory of how they ended up there: somebody has sent a 'help' to the list-request address. Mailman has replied, but for some reason the reply address has been dysfunctional. The mailer daemon then sends a bounce to the list-request address with the help message in an attachment. mailman processes the message, finds 'subscribe' in there, and subscribes.

Would it be possible to include some kind of tag or cookie (maybe an X header) in the outgoing messages? We could then search every incoming request message for the tag, and if we find one, we would then know the history of the message.