I'm surprised this hasn't happened before, @list.att.com is just a standard listserv type system, internally anyone can create and manage lists of email addresses with internal or external addresses in it and those lists are all open to the public internet if you know their address.
I can't remember if there is any kind of access control that the owner of the list can implement to prevent external messages to the list address but no longer have access to check.