The official Nmap mailing list stores user passwords in plaintext (nmap.org)

They use the newest version of Mailman (https://www.gnu.org/software/mailman/index.html), which has no password hashing features whatsoever. The last release was 4/28/15. What is this, '98?