This is only peripherally a mailman development issue. :)

I use all three steps, in this order:

• virus scan+block (inflex/uvscan)
• demime
• members-only posting

As a result, the worst I have ever had is a short, stripped text component appearing mysteriously on a list. And that happened because some PREVIOUS virus scanner out in the wild had caught the virus, removed it and PASSED THE REST ON. Thanks ever so much, whoever you were :)