My apologies for the spam that made it to the MLton and MLton-user list today. I simply use a whitelist that determines what "from" addresses may send to the list. I changed the whitelist yesterday and made the cardinal sin of including the list address in the whitelist. This allowed the spammers that faked the "from" address through. I've fixed the problem. Sorry.