Mark,

Here's a possible hitch I've come up with. If you are not a Groups.io
user at all, and send a message to a group and are instantly
subscribed, you've effectively bypassed the email confirmation step
and could receive email from the group without being opted-in.

Except in the case of your address being spoofed, I think it would be fair to conclude that your message itself constitutes opting-in for replies to that message. Otherwise what was the point?

Messages that pass SPF and/or DKIM I think you can accept as non-spoofed. For the rest, you may be right to immediately return an email confirmation message.

On a related note:
"Make the subscribe, unsubscribe, and other email commands reliable"
https://yahoo.uservoice.com/forums/209451-us-groups/suggestions/5806836

-- Shal