On 9/12/2017 10:46, Glenn Eichel wrote:
[log in to unmask]">
What can I check? Is there a way to rebuild the subscriber list?


It would be extremely useful for that user to display all of the email headers associated with that message and send them to you for analysis.  E.g., this is what you distributed message looks like to me. Looking at the topmost and 2nd (just below it), it is clear that this message was received by PSU via a LISTSERV (peer).

If it had come from some non-LISTSERV host, or lot's more unrelated (forwards/gateways), that would be suspect of some other service ...

Return-Path: <[log in to unmask]>
Received: from tr11n05.aset.psu.edu (r02n08-fddi.cac.psu.edu [146.186.157.8])
    by tr26n15.aset.psu.edu (8.15.2/8.15.2) with ESMTPS id v8CFjeeM22675962
    (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK)
    for <[log in to unmask]>; Tue, 12 Sep 2017 11:45:40 -0400
Received: from lychee.ease.lsoft.com (lychee.ease.lsoft.com [209.119.0.145])
    by tr11n05.aset.psu.edu (8.15.2/8.15.2) with ESMTPS id v8CFja9113631776
    (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO);
    Tue, 12 Sep 2017 11:45:37 -0400
Received: from [209.119.0.2] ([209.119.0.2:54698] helo=PEACH.EASE.LSOFT.COM)
    by camaro.dc.lsoft.com (envelope-from <[log in to unmask]>)
    (ecelerity 3.6.0.39694 r(Platform:3.6.0.0)) with ESMTP
    id 60/F6-02039-02108B95; Tue, 12 Sep 2017 11:45:36 -0400
DKIM-Signature: v=1; a=rsa-sha256; d=EASE.LSOFT.COM; s=DK1024; c=relaxed/relaxed; bh=1E2okUkZlY5H1ycWUA9xvUodkVLbBUe4dDprNV61iUg=; [log in to unmask];
 h=MIME-Version:Content-Type:Message-ID:Date:Reply-To:Sender:From:Subject:To:List-Help:List-Unsubscribe:List-Subscribe:List-Owner:List-Archive;
 b=znRq8SAWYAJq4PUjKSpc4aquqwbWdcUPjmA3hz/M2iL/WyhqLyof1JZvVpIZlUBImwP/xCQAMnmgcZc7+tyU5T1tWiOB/S+I1Aj5o5Lv+ssY1bDvkDoInJWCDq5pQWCklr5Y70gLBjMBjWRO3y8uWFW9Uhe9LDDZf4wdCEw7rHo=
Received: by PEACH.EASE.LSOFT.COM (LISTSERV-TCP/IP release 16.0) with spool id
          302787153 for [log in to unmask]; Tue, 12 Sep 2017
          11:45:24 -0400
Approved-By: [log in to unmask]
Approved-By: [log in to unmask]
Received: from mx-7.its.maine.edu (mx-7.its.maine.edu [130.111.32.95]) by
          RHONE.EASE.LSOFT.COM (SMTPL release 1.1d) (envelope-from
          <[log in to unmask]>) for [log in to unmask] with
          TCP; Tue, 12 Sep 2017 10:46:59 -0400
Received: from mail.umit.maine.edu (acropolis.umecit.maine.edu
          [130.111.228.13]) by mx-7.its.maine.edu (8.14.4/8.14.4) with ESMTP id
          v8CEkiJw030001; Tue, 12 Sep 2017 10:46:49 -0400
X-FC-Thread-ID: 004c4d19-6f333991
X-Mailer: FirstClass 11.1 (build 11.144)
X-FC-SERVER-TZ: 15729388
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="--=_--6f334011.6f333991.d5dda3d0"
X-DCC-UniversityOfMaineSystem-Metrics: mx-7.its.maine.edu; whitelist
X-MailScanner-Information: Please contact the ISP for more information
X-UmaineSystem-MailScanner-ID: v8CEkiJw030001
X-MailScanner: Found to be clean
X-MailScanner-From: [log in to unmask]
X-UmaineSystem-MailScanner-Watermark: 1505832413.00585@sRvAdsHx/OFOMbt02NBROw
Message-ID:  <[log in to unmask]>
Date:         Tue, 12 Sep 2017 10:46:40 -0400
Reply-To:     "LISTSERV Site Administrators' Forum"
              <[log in to unmask]>
Sender:       "LISTSERV Site Administrators' Forum" <[log in to unmask]>
From:         Glenn Eichel <[log in to unmask]>
Subject: Subscriber Issue
To:           [log in to unmask]
Precedence: list
List-Help: <http://peach.ease.lsoft.com/scripts/wa-PEACH.exe?LIST=LSTSRV-L>,
           <mailto:[log in to unmask]>
List-Unsubscribe: <mailto:[log in to unmask]>
List-Subscribe: <mailto:[log in to unmask]>
List-Owner: <mailto:[log in to unmask]>
List-Archive: <http://peach.ease.lsoft.com/scripts/wa-PEACH.exe?LIST=LSTSRV-L>


To unsubscribe from the LSTSRV-L list, click the following link:
http://peach.ease.lsoft.com/scripts/wa-PEACH.exe?SUBED1=LSTSRV-L&A=1