Does this mean “if any user knows the incoming email address, they can post to this category”? This can be prevented by not telling anyone that address, right?
But, presumably if someone gets a notification by email, they can reply. Is that reply sent to Discourse as a post, or to the mailing list?