> On Sat, 20 Mar 1999, Stan Ryckman wrote:
> > Another dense voice asks... if you're going to spoof the requests from
> > another address, why can't you set the password via the same route?
>
> From one Stan to another, if I knew the answer to your question, I would
> not have brought this subject up on the LSTSRV-L list. For some reason,
> although my attempts at your idea appeared to elicit favorable responses
> from Listserv, when I actually tried to use the password, Listserv claimed
> not to recognize it.

In order to create a password, you must be able to intercept the mail sent
to the address for which the password is being set, so that you can reply
with the correct confirmation code.  This is much harder than simply faking
the From address in a mail message.