I've seen it already happen, that spammer subscribed debian mailing list to send spam there. Since debian list policy recommends its members not to reject mail from it (quite correct I'd say, I did whitelist them), it may be interesting for spammers to spam through them
To me, it sounds like the debian list needs to change to moderator approval for subscriptions AND your ISP needs to use RBLs in a manner more consistent with understanding that it is not designed to be an MTA block.
Regards, KAM