commands accept non-existing accounts

Hello,

   I recently noticed that spammers are using my majordomo2 server to send
pointless messages to random email addresses. For example:

The following request:
 "password-show [email protected]"
was sent to The Mailing List Site on
 Wed Aug 30 02:47:17 2006
by [email protected].
   
The request was not completed because instructions
for the token DFFD-F454-581F could not be delivered to
 [email protected]
for the following reasons:
554 delivery error: dd This user doesn't have a yahoo.com account
([email protected]) [0] - mta205.mail.re4.yahoo.com

The token DFFD-F454-581F has been deleted, and is no longer valid.
<snip>

How can I lock down MJ2 so that commands will check to see if a user actually
 exists before sending out a message. If [email protected] is not a
registered user I don't want MJ2 emailing him.

Thanks,
Alex