Scott <scott@chronis.icgroup.com> wrote:

if someone sends a request via mail to subscribe to a list without requesting that an address other than the sending address be subscribed, maybe that should be allowed sans confirmation. it would still be possible to do mass prank subscriptions, but much more difficult.

Spoofing return addresses is trivial.