Privacy issue with ackreject

We have a case where, in order to encourage opt-in subscriptions in the 
absence of an actual "invite" operation, I added 400+ subscribers of 
list A at some other site -- who were notified via that list that they 
would be invited -- to a list at our site using "subscribe-rule" -- so 
they would receive confirmation requests.

When one of the recipients rejected the request, he received an 
acknowledgment that included all 400+ addresses in the rejection. 

That is, obviously, a significant privacy hole.

Can this be addressed in the software?  Obviously, it can be avoided by 
sending the requests as 400+ separate email messages, but even so, only 
the commands affecting a particular address should be sent to it...