[Mailman-Users] Replies from non-members getting posted to list set to allow posts by subscribers only

[Anthony R. Thompson]

I have a list which is set to reject posts from non-members (see 
settings below).

At one point I had an address (chiraelx at gmail.com) which was subscribed 
to the list (adf-www).

However, I unsubscribed it from the list sometime yesterday.  The 
list_members command confirmed that it is not subscribed to the list:

adf at lists:~$ list_members adf-www
adfrobbx at illious.com
ashipkowskix at gmail.com
athenamsbx at gmail.com
athompsx at adf.org
cefarrowx at gmail.com
crystalx at cedarlight.org
druidkirkx at mac.com
knottydragonx at hotmail.com
mjdx at chronarchy.com
nightdrumx at lycos.com
pegx at castingtherunes.com
selenex at zoomtown.com
skipx at dragonskeep.us
walks_alonex at hotmail.com
smgoochx at hotmail.com

I went into the inbox of that account, chiraelx at gmail.com, which is not 
a subscriber, and *replied* to one of the posts it had received when it 
*was* on the list.

I expected to get a rejection notice back since chiraelx at gmail.com isn't 
a subscriber but... the post went through.

I got it at the athompsx at adf.org address, I looked at the headers and it 
was sent From chiraelx at gmail.com with adf-www in the To and Reply-To 
fields, with adf-www-bounces in the sender field.  Further, I confirmed 
it by checking the mbox file for the list.

Amazed, I used list_members to confirm that chiraelx at gmail.com was not a 
subscriber, then replied to a different message (received when it /had/ 
been on the list), and that message went through too!

At this point I was paranoid that the list would allow anyone in the 
world to post, but when I tried posting from a different address (which 
had never been on the list at all), I got back the expected rejection 
notice.

I then posted from my athompsx at adf.org address, which /is/ a subscriber 
on the list, to see whether chiraelx at gmail.com would get the post, and I 
got the post back, it was added to the mbox file, but chiraelx at gmail.com 
did /not/ get the post.

So what I'm left with is a non-subscriber, which used to be a 
subscriber, apparently able to post to a list I'm pretty sure is 
configured to only allow posts from subscribers.

Does anyone have any experience or insight into this?  I searched the 
archives but couldn't find anything similar.

thanks,
Anthony

(I put x at the end of the user portion of various email addresses in 
this post just to spam protect them as I don't know how the archives for 
this list are configured)

List settings:
config_list -o - adf-www | egrep -v '#' | egrep -v '^ *$'

real_name = 'ADF-WWW'
owner = ['adfx at adf.org', 'drumx at yahoo.com', 'athompsx at adf.org']
moderator = []
description = 'ADF-WWW Mailing List'
info = ''
subject_prefix = '[adf-www] '
anonymous_list = False
first_strip_reply_to = 1
reply_goes_to_list = 1
reply_to_address = ''
umbrella_list = False
umbrella_member_suffix = '-owner'
send_reminders = 0
welcome_msg = 'Please note: All ADF electronic forums are moderated; the 
moderation policy is located at 
http://www.adf.org/forums/lists/moderation.html and you can always reach 
a human being at adf-listmasterx at adf.org'
send_welcome_msg = 0
goodbye_msg = 'If there are any reasons you chose to leave the list that 
you would like to share, please feel free to email us at 
adf-listmasterx at adf.org or adf-members-advocatex at adf.org'
send_goodbye_msg = 0
admin_immed_notify = True
admin_notify_mchanges = 1
respond_to_post_requests = 1
emergency = 0
new_member_options = 0
administrivia = True
max_message_size = 0
admin_member_chunksize = 50
host_name = 'lists.adf.org'
include_rfc2369_headers = 1
include_list_post_header = 1
max_days_to_hold = 0
preferred_language = 'en'
available_languages = ['en']
encode_ascii_prefixes = 0
nondigestable = True
msg_header = ''
msg_footer = """___________________________________________________________
Unsub: http://www.adf.org/forums/unsubscribe.html?%(list_name)s
List archives: http://lists.adf.org/archives/%(list_name)s/
Moderation policy: http://www.adf.org/forums/moderation.html
Questions?  Mail a human being at ADF-Listmasterx at ADF.ORG"""
scrub_nondigest = False
regular_exclude_lists = []
regular_include_lists = []
digestable = True
digest_is_default = False
mime_is_default_digest = False
digest_size_threshhold = 50
digest_send_periodic = True
digest_header = ''
digest_footer = 
"""___________________________________________________________
Unsub: http://www.adf.org/forums/unsubscribe.html?%(list_name)s
List archives: http://lists.adf.org/archives/%(list_name)s/
Moderation policy: http://www.adf.org/forums/moderation.html
Questions?  Mail a human being at ADF-Listmasterx at ADF.ORG"""
digest_volume_frequency = 3
advertised = 0
subscribe_policy = 2
unsubscribe_policy = 0
ban_list = []
private_roster = 1
obscure_addresses = 0
default_member_moderation = 0
member_moderation_action = 0
member_moderation_notice = 'If you have any questions about this notice, 
please contact adf-listmasterx at adf.org'
accept_these_nonmembers = []
hold_these_nonmembers = []
reject_these_nonmembers = []
discard_these_nonmembers = []
generic_nonmember_action = 2
forward_auto_discards = 0
nonmember_rejection_notice = 'If you have any questions about this 
notice, please contact adf-listmasterx at adf.org'
require_explicit_destination = 1
acceptable_aliases = ''
max_num_recipients = 8
header_filter_rules = []
bounce_matching_headers = ''
bounce_processing = True
bounce_score_threshold = 5.0
bounce_info_stale_after = 7
bounce_you_are_disabled_warnings = 3
bounce_you_are_disabled_warnings_interval = 7
bounce_unrecognized_goes_to_list_owner = True
bounce_notify_owner_on_disable = True
bounce_notify_owner_on_removal = True
archive = True
archive_private = 1
archive_volume_frequency = 3
nntp_host = ''
linked_newsgroup = ''
gateway_to_news = 0
gateway_to_mail = 0
news_moderation = 0
news_prefix_subject_too = 1
autorespond_postings = 0
autoresponse_postings_text = ''
autorespond_admin = 0
autoresponse_admin_text = ''
autorespond_requests = 0
autoresponse_request_text = ''
autoresponse_graceperiod = 90
filter_content = 1
filter_mime_types = ''
pass_mime_types = ''
filter_filename_extensions = """exe
bat
cmd
com
pif
scr
vbs
cpl"""
pass_filename_extensions = ''
collapse_alternatives = True
convert_html_to_plaintext = True
filter_action = 1
topics_enabled = 0
topics_bodylines_limit = 5
topics = []