Lsv.uky.edu hosts arlis-l which had been plagued by spammers. To try to
defeat them we have these settings on the list:
Confidential= No
SEND= private 
Default-options= Repro, nomime, subjecthdr, review
EDITOR= owner-address,(ARLIS-L)

New subscribers are set to noreview after a test period. Some spam hit
the list today. The owner avers that it never came in to be approved and
she wants to know how it got on the list. 

How could this protection have been breached?

Is there a more effective combination of settings to stop spam? 

Thanks to all