Hi there @scasa, 

Welcome to the Community! Happy to help investigate here!

Do you mind sharing whether your Main list was set to  double opt in before or after the spam bots signed up? We recommend double opt in as that second confirmation is a safety step that prevents bots or malicious parties from entering your list! Additionally, do you know how many of customers said they received a confirmation email when they didn’t sign up and whether this is still happening? Is there a pattern of actions they all took before they got the email?

If you have deleted the forms and there are no additional subscribe pages you’re sending customers to to sign up to your List, I would investigate if there are duplicate klaviyo stores on your website which could still be sending out subscription emails, more in the thread below, or whether or not you have flows that are live on your website’s integration, like Shopify? 

Finally, do you see these subscription emails continuing to go out after you posted this thread? 

Thank you! Looking forward to solving this together!

-Taylor 

Hi Taylor, yes my subscription is set to double opt in from the start. One of the emails I received saying that they didn’t subscribe to my newsletter is titled “confirm your subscription”. I’m also constantly receiving automated emails like out of office messages from people when I haven’t sent them any emails. 

There also isn’t a duplicate klaviyo store on my website. I wouldn’t even know how to have duplicate stores. The shopify automation is off as all emails are sent from Klaviyo.

Hi all, 

@scasa was connected to a Support team member to figure out why users were being added to her list when they claimed they hadn’t filled out any forms, especially after forms were removed from her site.

Our support team member suggested connecting with Shopify and providing profile examples to pinpoint why the list bombing was happening and encouraged added ReCaptcha to forms to prevents these malicious bots! 

-Taylor