Kevin Israel discovered that python3-django-postorius, the administrative web frontend for Mailman 3, didn"t validate whether a logged-in user owns the email address when unsubscribing.