Filters apply as you choose them.
Remote attacker can execute commands through Majordomo using the Reply-To field and a "lists" command.