There are a couple things to do that can at least cut down on spam.
1) Make sure that your mail gateway, or (in this case) the mailing list host is not an open relay site.
It isn't.
2) Every time you get spam, locate all the hosts it came through in the header.
Or alternatively just report it using Spamcop (http://spamcop.net) or some other reporting tool. Life is just too short to do this by hand every time you get spam. On the Haskell mailing list we have a good compromise at the moment: the mailing list software's auto-filtering catches most of the spam (not allowing Bcc's to the list is a good one), and for any spam that gets through I just add it to the list of disallowed addresses. I asked recently if we should move to allowing subscriber-only posting, and I got a small number of responses, which were split roughly 50/50 so no action was taken. Cheers, Simon