>4) Once all confirmations are acknowledged, activate the forwarding
>   option and direct all incoming [log in to unmask] mail to
>   [log in to unmask]

We had such an attack a few weeks ago from an account at GMX.DE.

The perpetrator had subscribed his GMX account to 31 lists on our server
and then he set a forward to the mailbox of a member of the ZDF (one of
our national TV stations) shortly before official holidays... Since that
time we are using two simple Perl scripts to identify such attacks more
easily. The first Perl script is named 'substat' and helps to identify
multiple subscriptions from one e-mail address. The second Perl script is
named 'listcomp' and compares two or more different lists in order to find
common addresses. With these tools, it is more easy for a LISTSERV
maintainer to identify such attacks. I don't know much about Perl and I
did not create these scripts myself, so I cannot explain how these scripts
work in detail, but if you are interested, I can send a copy of these Perl
scripts.

Siegfried

PS: we are using LISTSERV 1.8c in an HP-UX 10.20 environment.