[Mailman-Users] Message from a non-subscriber (Dropbox) on a member-only list

[Stephen J. Turnbull]

dc writes:

 > How can a non-subscribed address (From: Dropbox 
 > <no-reply at dropboxmail.com>) post to a closed mailing list?

That would not authorize the post.  However, From is not the only
datum checked.

 > Why wasn't this invitation rejected?

Because the sender's address appeared in one of the other data used to
identify a member post.

 > (The person who had the invitation sent is a subscriber, but her
 > address doesn't appear in any of the headers.)

It doesn't appear in any of the fields visible to you.  However, not
all MUAs display the "Sender" field (although Microsoft MUAs display
real confusion when one is present), and few display the "Reply-To"
field.  Finally, it may be in the "envelope sender".

To change which data are used to determine the header, customize the
USE_ENVELOPE_SENDER and/or SENDER_HEADER options in mm_cfg.py.
(Documentation and defaults are in Defaults.py, but you should not
edit that file.)