Its actually fairly easy to setup a decent mailing list without having to have approved senders, but Exchange and its built in functionality is probably the root cause of a lot of these.

The ones I have setup are pretty easy to stop since we do some basic checking of the e-mails sent anyway (e.g. attachment too large).

O365 (commonly used at large enterprises) makes this dead simple too. You can even have it be self-service, where individuals can empower themselves to have access to a list-serv (its not just "CEOs").