It has been '0' days since someone piped the Ubuntu security announce mailing list into their Jira, then Jira generated a ticket for the latest Ubuntu update email and sent it to the mailing list, and *Canonical's mailing list configuration let it be sent to everyone signed up to get Ubuntu security announcements*.
Challenge: set your announcement mailing lists to only allow your announcements, not random (auto)replies. Difficulty: impossible, apparently.