Same thing happened at my university. Chair of the student's committee accidentally included the list as a cc instead of bcc. My brother managed to rickroll the whole campus.

Soon after the security of the listserv was fixed.