non-zero number of spam emails
Only members have permission to post to the list. Therefore, an attempted
spam would be originating from a list member, who signed up, and
confirmed.  After you notice this, are you setting the user to "reject"
their emails?