The person who's sending in the unsubscribe requests is most likely doing it through the webpage form at http://www.winduplist.com/ls/discuss/form.asp. On that form, all a person does is enter the e-mail address, the list, and the command. No password is needed, because your e-mail isn't accessed. I would assume it just reads your e-mail address and the command. Luckily, Ed changed it so that the e-mail address requesting the unsub request now has to confirm it before it takes effect. No reason to be paranoid, it's just someone playing games. They don't have access to your e-mail, otherwise they probably would have confirmed the request through your account. No need to be paranoid. =)