I've sent this to support, but since I'm trying to deal with this quickly,
I'm also asking the user community.

One of our lists with over 6k subscribers, has a potentially
difficult situation that I believe could affect any listserv list. One of
their members subscribed to drop_spam. When a post went to the list, the
outgoing post to the dropspam subscriber was intercepted by drop_spam.
Drop_spam then spoofed and email to the original sender, appearing to come
from lm_net, telling the sender to click on a link to approve the message.
Clicking on the link is to register with dropspam. This obviously causes
mass confusion, and gets dropspam a bunch of registrations under false
pretenses. The list has been notified NOT to click on the link, but a
number probably already have. We would like to identify folks who have
registered with dropspam so we can deal with this. My first thought is to
do an immediate active probe which would generate, but dropspam will
probably sanitize their email of any indication of the sender. Any
suggestions? A custom email to all subscribers with a unique
subject? Here's an example:
---------------------------->
<[log in to unmask]> Received: from aae.dropspam.com
>(98.70-84-212.reverse.theplanet.com
>    [70.84.212.98] (may be forged))
>       by eryx.syr.edu (8.12.10/8.12.10) with SMTP id j96MiOjp004216
>       for <[log in to unmask]>; Thu, 6 Oct 2005 18:44:25 -0400 (EDT)
>Received: (qmail 23741 invoked by uid 101); 6 Oct 2005 23:39:33 -0000
>Date: 6 Oct 2005 23:39:33 -0000
>Message-ID: <[log in to unmask]>
>From: [log in to unmask]
>To: [log in to unmask]
>Subject: [URGENT] - URGENT RESPONSE REQUIRED
>Content-type: text/plain
>Content-Length: 733
>
>Dear [log in to unmask],
>
>- URGENT RESPONSE REQUIRED -
>
>Please note, an immediate response is required to prevent your messages
from b$
>
>Your e-mail to [log in to unmask] was NOT delievered.
>
>Your Original E-mail Subject: [LM_NET] GEN: A Sample EL-Announce Posting
>
>[log in to unmask] is protected against viruses and spam by
www.dropspam.$
>
>Please follow this link to add yourself to the approved sender list of
LM_NET@$
>
>http://verify.dropspam.com/verify.cgi?key=2371/pmilbury%40IIS.SYR.EDU/aae01773$
>
>
>
>Thank you!
>
>
>Dropspam.com
>
>Block 100% of viruses and spam.
>http://www.dropspam.com
>