>[. . .] I haven't tested this, but if Lsoft
>tells me that review=postmaster is already functional, well, I'll take
>them all out for a beer. ;-)

 From the site manager's guide:

> +----------------------+
> | Review= access-level |
> +----------------------+
>
> This keyword defines the categories of users who are allowed to review the
> (non-concealed) Internet addresses and names of the persons subscribed to a
> list. Beginning with version 1.8c, the default value is "Review= Private".

And:

> access-level    Controls which category of users has access to the
>                 information or service to which this parameter applies.
>                 access-level can  be either:
>
>                 Public      Everybody has access to the information.
>                 Postmaster  Only the postmaster (i.e. LISTSERV operations
>                             staff) has access to the information.
[other possible values omitted]

So there you have it.

Of course the listowner still could get access to the list of
addresses subscribed in a bunch of different ways, including the
following:

1) GET listname (NOLOCK

This sends the listname.list file, which includes a list of all the
subscribers.

2) Q listname FOR *@*

3) GET listname (HEADER
modify list header so * Review= Owner (or whatever)
    PUT listname
issue review and then change listname configuration to what it was before

4) QUIET DEL listname *@*
will delete everyone from the mailing list and send a list of the
addresses deleted to the issuer of the command; presumably the
listowner would then QUIET ADD everyone back (losing any customized
settings, admittedly).

If you want to hold onto your beer money after those revelations I
think it's understandable.  ;-)

-jwgh