Public thanks to Tim Pierce for his analysis of how the newapt worm switches From: and To: headers around. I sent every list member an announcement, with some headers designed to make it look like a mailing list distribution to most of their filters (for those who filter at all), but the To:, From:, and Reply-To: headers and the enve- lope sender address were all suffixed with the recipient's address, VERP- style. One sent the worm back in reaction, and her own address was all over it. I deactivated her subscription and sent her a message asking her to clean her system and get back to me. (Of course, tomorrow I'll have another copy of the worm in response to that.)
