Doug - I patched around this, with smartlist. If you don't get an
answer from the Smartlist folks, let me know.
What I did, is I had the script look for "admin" in the subject lines
sent to the -request alias, and then processed each line in the
body (up to the .sig separator) as if it had been supplied in an
X-Command. I didn't do any password checks, but rather just checked
the From: address to see that it matched the maintainer's address.
This approach has made it easy for folks to remotely manage lists,
hosted at our site, and is accessible from a simple mail program,
without elaborate methods for inserting X-Command into the header.