Oh, good point! I hadn't thought about the automatic backlinks; I figured if we aren't stupid enough to add them back, what can they gain? nofollow makes a lot of sense here (for both "other subscribers" and "also grants access"). It's less invasive (for us legitimate users) than not showing those lists publicly but only to the account owner, which would be another way to deny them their links but takes away useful info for some.

Your latest spambot seems to be (impersonating someone who is) trying to make a career in pond scum. Go with what you know, I guess!