Hi Stefano,
it’s very unlikely that this is a bot trying subscription, I guess. We should then see much more non-confirmed subscribers. Our Provider told us, that more than 3000 emails were sent through subscribe.php from a romanian IP. But we had only 10 or so non-confirmed subscriptions. Very weird. We blocked the IP. That seems to do the trick. However, would be nice to know what’s going on here. The Support told us also that this problem appeared on several installations of other customers. I’ll keep you posted. Don’t get me wrong: I don’t blame the plugin for having any security issues.