I just noticed while working on another listmail project that I may have found a small bug...
I've been uploading single opt-in leads to email my confirmation request to attempt to get them to double-opt-in. I just noticed in the /tmp directory of my server that there are some files there over a week old owned by apache.
Upon examining these files, they are the lead files I have been importing. I'm guessing these should be getting deleted after importing but aren't. Not a HUGE deal, but on a shared server if someone could get access to these files it may not be good.