[Entering my bug into the tiny window might have folded the lines. Good thing I now have ADSL, as you don't accept bugs by email.]
At many places one sees
Messages containing an Approved: header with the list owner password
are still allowed through
Then, when the message shows up in your mailbox, make your edits and
resend the message to the list, including an Approved: header with the
list password as its value.
Which promptly gets sent to the list, one then thinks. List password
or moderator password or both etc.
or more in templates/* etc.
The user thinks "oh great, the software intends so ever nonchalantly
to send the master password in all four directions."
Therefore remember to assure the user each time you broach the issue,
that the password will be replaced by <what?> and he can be rest