It was inevitable - a spammer has found our ListServ info page and is now
using our domain and the ListServ admin and list addresses in the forged
headers of some spam runs.  It seems that the scumbag's automated processes
also added the posting address of one of our lists to their recipient list.
Their spams are being sent to the list (but are being stopped by the
moderator not releasing them).

My question is this:  I thought that we had set the List headers to not allow
postings from non-subscribers, and that anything posted would have to go
through the moderator anyway.  Is my understanding correct?  If a person is
not subscribed, anything they send to the list posting address should not
even hit the moderation queue.  

If my understanding is not correct, how can I achieve a moderated list and
keep messages from non-subscribers from hitting the moderation queue?

Portions of the list header reproduced below:

.HH ON
Send= Editor,Hold,Confirm
Editor= [log in to unmask]
Editor-Header= No
Default-Options= NODIGEST,SUBJECTHDR,NOACK REPRO
Default-Options= CONCEAL
Language= NOHTML,EXCHANGE
Notebook= Yes,e:\archives\listname,Monthly,Private
Notebook-Header= Short
Service= *
Change-Log= Yes,Daily
Attachments= No,Filter
Notify= Yes
Moderator= All,[log in to unmask]
Subscription= Open,Confirm
Ack= No
Confidential= No
Validate= All,Confirm
Reply-to= List,Ignore
Review= Owners
Owner= [log in to unmask]
Digest= Yes,Same,Daily,BOTTOM_BANNER
.HH OFF