Subscribe2 Hijacked

Using 8.5 of Subscribe2. Apparently, the subscription setup has been hijacked and used to forward thousands of emails, ending up getting my server blacklisted. Anyone aware of the hole? Or a workaround?

http://wordpress.org/extend/plugins/subscribe2/