One of the earliest enforcement actions was against a mailing list. If I remember it was because it CCed all the participants instead of BCCing them.