All a spam program would have to do is say "[EMAIL PROTECTED] posts lots to that list. His address must be a trusted subscriber. Well, here's one more post from him, muhahaha."
If "Bob" posts a lot to a list(s) and is respected within said list(s), then the other subs of that list will immediately recognize by the tone and the writing style of a fake message that it wasn't Bob that sent it.
OK, I suppose that would be caught by SPF rules etc., if bob likes SPF.
Not all mail systems actually block upon SPF breakage... Steve