This is obviously a problem, but the fix is not quite obvious. The
obvious thing to do is to change the subject to whatever, but that's not
clearly the right thing to do, because it loses context of the original
message. We could specify that this happens unless a List-* header is
present or unless Auto-Submitted is not present or set to no (I have no
idea if this header was ever documented).
Neither would stop spammers saying: "We use opt-in with address
verification, and you did verify your subscription request". They won't
be stupid enough to make their newsletter system look like a regular
mailing list, because they *want* vacation responses to be sent in order
to gain subscribers.
[database size of vacation message recipients]
I figure a thousand is enough for a lower limit, but maybe that should
be a SHOULD.
1000 would be fine with me, because most people get mail from fewer
addresses within a week, so the average of large systems should be less
by far.
Michael