Mike Wertheim writes:
One of the email addresses on the list used a custom personalized domain, which started bouncing. I didn't notice the bounces at the time.
In addition to what Mark says, you should also investigate this. You should not need to notice the bounces. Mailman can be configured to notice the bounces (with some exceptions for unusual formats for the bounce messages), and after a certain number have been received, it disables the subscription and starts sending messages "your subscription has been disabled, here's how to reenable it", and if those also bounce, after a certain number the subscription will be deleted. How strict this policy is is configurable per-list using the standard Mailman list configuration page "Bounce processing".
It's possible that you have a reasonable bounce policy and it's been working but you never noticed it, and the problem here was a heavily redacted bounce message that doesn't allow Mailman identify the subscriber, or an unusual bounce format that Mailman didn't recognize. In both cases setting the VERP_DELIVERY_INTERVAL=1 as Mark recommends is the best defense we can offer without your host patching Mailman.
In the latter case, if you have a copy of the bounce notice, we'd appreciate it if you'd send us a copy so we can improve detection in the future. Please obfuscate any personally identifying information such as email addresses, host names, and IP addresses. It would help a lot if you make sure the replacement text has the appropriate format, a@b.c for email, 0.0.0.0 for IP addresses etc.
Steve