Have you been using SUBSCRIPTION= OPEN,CONFIRM
and SEND= EDITOR and EDITOR= realuserid@node,(listname)
in your lists' definitions?
 
This inhibits 99.9 % of SPAMs distributed to the
list's membership.  I know: I'm the one that gets
them via the interception and forward.
 
Pete Weiss at Penn State