[Mailman-Users] mailman sending password reminders to members no longer subscribed

[Jim Dory]

Subscription only is simply emphasizing that one has to be a subscriber to
the list. Perhaps this is the only way, I don't know, nor care.

How do I know? Both users replied to the email reminder so it went to the
list owner - me. I could look at the email address on the reminder and the
email on the reminder does not exist in the list of subscribers, both cases.

Mark was helpful in his suggestions: I'll have to get one of the folks to
forward me the password reminder so I can look at the headers. We did
upgrade our package with our host company so maybe the old is still active.

thanks all, Jim



On Wed, Nov 2, 2016 at 6:26 AM, Stephen J. Turnbull <
turnbull.stephen.fw at u.tsukuba.ac.jp> wrote:

> Jim Dory writes:
>
>  > I've gotten a couple complaints today from ex-members on our
> subscription
>  > only mailman list
>
> What do you mean by "subscription only"?  That's not a term we use as
> far as I know.
>
>  > after they received password reminders. They are not subscribed,
>
> How do you know that?
>
>  > so I can't honor their request to be removed from the mailing list.
>
> Well, they're subscribed *somewhere*.  Generally speaking, there are
> two possibilities.  First is that in the process of an upgrade, you
> ended up with two installations, one of which is basically dormant
> except for sending out password reminders or something.  Are any users
> reporting duplicate reminders?  If not, this is probably not the
> case.  On the other hand, if some users are not getting reminders at
> all, you probably do have a redundant installation that's still
> active.
>
> The second is that these users didn't unsubscribe the addresses that
> are receiving the password reminders.  One possibility is that they
> set their addresses to "no mail" rather than unsubscribing, which
> would explain not receiving posts but receiving reminders.  A second
> is that they had multiple addresses for the purpose of posting, but
> all but one were set to "no mail", and the users didn't unsubscribe
> their post-only addresses.
>
> In a stock Mailman installation the reminder message is addressed to
> the subscribed address in "To" in the header and the subscribed
> address is also present in the body.  Ask these users to check that
> these addresses are the one they unsubscribed.  Note that users may
> have changed their preferred addresses, but are still receiving
> reminders at the old address via some kind of forwarding setting.
>
> Finally, it's possible that these messages aren't from Mailman at all,
> but some kind of spoof to get them to click on a link.  Highly
> unlikely, I guess, but to be complete.
>