If I am using a list as a newsletter, couldn't someone simply spoof a return address that is the same as the administrators e-mail address and still post to the list?