Replies from non-members getting posted to list set to allow posts by subscribers only

I have a list which is set to reject posts from non-members (see settings below).
At one point I had an address (chiraelx@gmail.com) which was subscribed to the list (adf-www).
However, I unsubscribed it from the list sometime yesterday. The list_members command confirmed that it is not subscribed to the list:
adf@lists:~$ list_members adf-www adfrobbx@illious.com ashipkowskix@gmail.com athenamsbx@gmail.com athompsx@adf.org cefarrowx@gmail.com crystalx@cedarlight.org druidkirkx@mac.com knottydragonx@hotmail.com mjdx@chronarchy.com nightdrumx@lycos.com pegx@castingtherunes.com selenex@zoomtown.com skipx@dragonskeep.us walks_alonex@hotmail.com smgoochx@hotmail.com
I went into the inbox of that account, chiraelx@gmail.com, which is not a subscriber, and *replied* to one of the posts it had received when it *was* on the list.
I expected to get a rejection notice back since chiraelx@gmail.com isn't a subscriber but... the post went through.
I got it at the athompsx@adf.org address, I looked at the headers and it was sent From chiraelx@gmail.com with adf-www in the To and Reply-To fields, with adf-www-bounces in the sender field. Further, I confirmed it by checking the mbox file for the list.
Amazed, I used list_members to confirm that chiraelx@gmail.com was not a subscriber, then replied to a different message (received when it /had/ been on the list), and that message went through too!
At this point I was paranoid that the list would allow anyone in the world to post, but when I tried posting from a different address (which had never been on the list at all), I got back the expected rejection notice.
I then posted from my athompsx@adf.org address, which /is/ a subscriber on the list, to see whether chiraelx@gmail.com would get the post, and I got the post back, it was added to the mbox file, but chiraelx@gmail.com did /not/ get the post.
So what I'm left with is a non-subscriber, which used to be a subscriber, apparently able to post to a list I'm pretty sure is configured to only allow posts from subscribers.
Does anyone have any experience or insight into this? I searched the archives but couldn't find anything similar.
thanks, Anthony
(I put x at the end of the user portion of various email addresses in this post just to spam protect them as I don't know how the archives for this list are configured)
List settings: config_list -o - adf-www | egrep -v '#' | egrep -v '^ *$'
real_name = 'ADF-WWW' owner = ['adfx@adf.org', 'drumx@yahoo.com', 'athompsx@adf.org'] moderator = [] description = 'ADF-WWW Mailing List' info = '' subject_prefix = '[adf-www] ' anonymous_list = False first_strip_reply_to = 1 reply_goes_to_list = 1 reply_to_address = '' umbrella_list = False umbrella_member_suffix = '-owner' send_reminders = 0 welcome_msg = 'Please note: All ADF electronic forums are moderated; the moderation policy is located at http://www.adf.org/forums/lists/moderation.html and you can always reach a human being at adf-listmasterx@adf.org' send_welcome_msg = 0 goodbye_msg = 'If there are any reasons you chose to leave the list that you would like to share, please feel free to email us at adf-listmasterx@adf.org or adf-members-advocatex@adf.org' send_goodbye_msg = 0 admin_immed_notify = True admin_notify_mchanges = 1 respond_to_post_requests = 1 emergency = 0 new_member_options = 0 administrivia = True max_message_size = 0 admin_member_chunksize = 50 host_name = 'lists.adf.org' include_rfc2369_headers = 1 include_list_post_header = 1 max_days_to_hold = 0 preferred_language = 'en' available_languages = ['en'] encode_ascii_prefixes = 0 nondigestable = True msg_header = '' msg_footer = """___________________________________________________________ Unsub: http://www.adf.org/forums/unsubscribe.html?%(list_name)s List archives: http://lists.adf.org/archives/%(list_name)s/ Moderation policy: http://www.adf.org/forums/moderation.html Questions? Mail a human being at ADF-Listmasterx@ADF.ORG""" scrub_nondigest = False regular_exclude_lists = [] regular_include_lists = [] digestable = True digest_is_default = False mime_is_default_digest = False digest_size_threshhold = 50 digest_send_periodic = True digest_header = '' digest_footer = """___________________________________________________________ Unsub: http://www.adf.org/forums/unsubscribe.html?%(list_name)s List archives: http://lists.adf.org/archives/%(list_name)s/ Moderation policy: http://www.adf.org/forums/moderation.html Questions? Mail a human being at ADF-Listmasterx@ADF.ORG""" digest_volume_frequency = 3 advertised = 0 subscribe_policy = 2 unsubscribe_policy = 0 ban_list = [] private_roster = 1 obscure_addresses = 0 default_member_moderation = 0 member_moderation_action = 0 member_moderation_notice = 'If you have any questions about this notice, please contact adf-listmasterx@adf.org' accept_these_nonmembers = [] hold_these_nonmembers = [] reject_these_nonmembers = [] discard_these_nonmembers = [] generic_nonmember_action = 2 forward_auto_discards = 0 nonmember_rejection_notice = 'If you have any questions about this notice, please contact adf-listmasterx@adf.org' require_explicit_destination = 1 acceptable_aliases = '' max_num_recipients = 8 header_filter_rules = [] bounce_matching_headers = '' bounce_processing = True bounce_score_threshold = 5.0 bounce_info_stale_after = 7 bounce_you_are_disabled_warnings = 3 bounce_you_are_disabled_warnings_interval = 7 bounce_unrecognized_goes_to_list_owner = True bounce_notify_owner_on_disable = True bounce_notify_owner_on_removal = True archive = True archive_private = 1 archive_volume_frequency = 3 nntp_host = '' linked_newsgroup = '' gateway_to_news = 0 gateway_to_mail = 0 news_moderation = 0 news_prefix_subject_too = 1 autorespond_postings = 0 autoresponse_postings_text = '' autorespond_admin = 0 autoresponse_admin_text = '' autorespond_requests = 0 autoresponse_request_text = '' autoresponse_graceperiod = 90 filter_content = 1 filter_mime_types = '' pass_mime_types = '' filter_filename_extensions = """exe bat cmd com pif scr vbs cpl""" pass_filename_extensions = '' collapse_alternatives = True convert_html_to_plaintext = True filter_action = 1 topics_enabled = 0 topics_bodylines_limit = 5 topics = []

Anthony R. Thompson writes:
At one point I had an address (chiraelx@gmail.com) which was subscribed to the list (adf-www).
Do you mean (as implied by your access to the inbox) that this is your personal address?
If so, I don't know if GMail allows this, but is it possible that you configured that account to automatically have an Approved header?
default_member_moderation = 0 member_moderation_action = 0 member_moderation_notice = 'If you have any questions about this notice, please contact adf-listmasterx@adf.org' accept_these_nonmembers = [] hold_these_nonmembers = [] reject_these_nonmembers = [] discard_these_nonmembers = [] generic_nonmember_action = 2
Looks OK to me. Maybe Mark will have a better idea though.

Anthony R. Thompson wrote:
I went into the inbox of that account, chiraelx@gmail.com, which is not a subscriber, and *replied* to one of the posts it had received when it *was* on the list.
I expected to get a rejection notice back since chiraelx@gmail.com isn't a subscriber but... the post went through.
I got it at the athompsx@adf.org address, I looked at the headers and it was sent From chiraelx@gmail.com with adf-www in the To and Reply-To fields, with adf-www-bounces in the sender field. Further, I confirmed it by checking the mbox file for the list.
The archives/private/LIST.mbox/LIST.mbox file will show the original Sender: header if any, but the original Reply-To: was munged by your first_strip_reply_to and reply_goes_to_list settings before the message was archived.
Did you send the reply from gmail web mail or from a mail client. If from a client, check what it puts in Reply-To: or in any case, send another test with a Bcc: to your direct address and see what you get there.
[...]
So what I'm left with is a non-subscriber, which used to be a subscriber, apparently able to post to a list I'm pretty sure is configured to only allow posts from subscribers.
If you haven't changed SENDER_HEADERS in mm_cfg.py, the relevant headers for testing list membership for posts are From: Reply-To: Sender: and the envelope sender. The original From: and Sender: headers will be in the message in the archives/private/LIST.mbox/LIST.mbox file and the envelope sender will be in the initial "From " separator line in the .mbox, but you can't see the initial Reply-To: because you mung it.
You could just generate a reply as you did in your two tests, but then change the To: address from the list to you to see what Reply-To: header you get.
[...]
first_strip_reply_to = 1 reply_goes_to_list = 1
Reply-To munging
[...]
accept_these_nonmembers = []
Good.
[...]
generic_nonmember_action = 2
Reject. Good.
-- Mark Sapiro <mark@msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan
participants (3)
-
Anthony R. Thompson
-
Mark Sapiro
-
Stephen J. Turnbull