Someone probably has the adress for the list request and names of people on the list in there address book with a vulnerable mailer. My guess is not everyone got that message.