It was actual mailing lists, and site signups - how many spammers do you know that sign you up for [log in] membership on redhat.com? :-) I thought initially it might be email harvesting going on, but from the types of email spam I got, I know it's not that.
I got some confirmation requests, but some mailing lists are still semi-reputable that don't have this system.