Brian Kantor said:
Mailman doesn't have CAPTCHA.
Here's a patch for adding reCaptcha support to Mailman:
https://www.dragonsreach.it/2014/05/03/adding-recaptcha-support-to-mailman/
It does use a challenge; when you request to subscribe, it mails you a key that you have to mail back, but I know that bot subscribers have already automated that. It helps keep some undeliverable addresses from subscribing, but it's not designed as a real security measure.
My standard practice (on all Mailman instances I admin) to prevent "drive-by spamming" is configuring lists so that new subscribers are moderated and checking their initial submissions. It does require a bit of the moderator's time, but Mailman's WebUI makes the process quite easy.
Moderation is a good tool for weedinf out problem subscribers. Use the control at the bottom off /mailman/admin/<list-name>/members to turn on/off everyone's moderation bit.
73,