From the mailing list,  opening an issue as requested by ralf.

- HTML attachments should not be served as text/html, see discussion on
  roundup-users under the title "Spam attack, observations, how to
  repair". I've committed a partial fix but this needs more work:

  Browsers seem to be interpreting *any* content-type without a '/' as
  html. This is actively used by spammers. Since we don't currently have
  nofollow set for attachments, search engines happily index these
  pages.

  There is no issue yet, if someone has time and wants to contribute,
  making an issue for this would be a welcome contribution. If you do
  this, please set me on the nosy list.

The email thread Ralf referred to is at:

http://permalink.gmane.org/gmane.comp.bug-tracking.roundup.user/10733