sub/unsub behavior

I did a few tests and found anyone can subscribe/unsubscribe any email
address to my Smartlist by a "sub/unsub [email protected]".
(The part worries me is the sub'ed/unsub'ed address does not receive a
confirmation from the server - the confirmation is sent to the
address that issued the requests only).

I checked through the 'rc.custom' but didn't identify the line that
control this behavior.  Could someone please advice for my possible
oversight?


Also I have a comment on the format of the 'rc.custom' file -- often
I am confused as which line to "uncomment", as in (quote):
----------------------------------------------------quote start
#auto_subscribe =  yes
##auto_subscribe            # uncomment to disable unattended
                            # subscription handling
#auto_help
##auto_help     =  yes      # uncomment to enable default help
                            # responses to all undecipherable
                            # requests
-----------------------------------------------------quote end
as the format in the quoted examples are not consistent, which leads
one to twist the tongue for the logic wordings -- the first line (with
single '#') or the 2nd line (with double '##')?  Or the line with
'yes' or the line without 'yes'?  Although I could have a good bet
after a couple seconds on the 2nd ('##') line, I would suggest leave
only one line for "comment"/"un-comment" for more clarity.  In my
opinion the first lines as perhaps headers only adds confusions. 
Comments?

Thanks in advance.

Zhiliang