> The posting (obviously forged) came from listname@listserv-hostname  in
> other words, the posting address for the list. This "username" is not a subscriber to the list.
> (...) [The list is] currently set to
> Subscription= By_Owner and  Send= Service, where Service= our-local-email-domain

Assuming that 'listserv-hostname' is part of 'our-local-email-domain', this configuration does allow the sending address to post to the list. Then the loop detector might reject the message, but in terms of access control, it does pass the "Send=" test. This is not an "access denied" scenario. Presumably, the spam does not look like a genuine LISTSERV message at all and the loop detector did not think the list was in a loop. If you are concerned about this, you can always use "Filter=" to ban this address, but I imagine that you also get a fair amount of spam from "random-but-valid-user-mailbox@our-local-email-domain". This is the price to pay for the trade-off of allowing any local e-mail address to post vs. just the subscribers.

  Eric