Differently from previuos drupal 5.x.1 , when the anonymous user has the "access user_mailman_register" permission control, it could able to join any list of which he has also the "can subscribe .." permission. Don't activate that permission if you don't know what are you doing or your lists coul be spammed by anonymous emails. If you activate it, set the "invite" list option if you want only invite them.