I get more and more tempted to teach our mail filtering infrastructure about the most common ones, so that it can automatically acknowledge the challenges, discard the messages, and not bother the users with them at all[...] And I'd clearly be doing our users a service, especially if C/R systems get widespread.

As a user, I don't agree that you'd "clearly" be doing me a service by forging an acknowledgement in my name.

Firstly, it's not obvious that the legal threats in the challenge are necessarily as toothless as you seem to be assuming. If you send a confirmation in my name without my consent or knowledge, and the challenge contained an attempt to enter me into a contract (e.g. this one attempting to collect $2000 for each piece of spam from anyone who answers the challenge), it may end up wasting much more of my time than I would have spent answering (or ignoring) challenges--regardless of whether or not the contract could actually be enforced.

Secondly, I do not want it to be transparent to me that the user I am corresponding with is using a C/R system. I should have the opportunity to decline to correspond with the sort of people who put "keep out" signs on their mailboxes.

In any case, tempting though it may be, messing with the perceptions of the parties involved (of the C/R user, who will assume that his challenge was seen and deliberately acted on, and of the correspondent, who will not know that a C/R system is in use) is to flirt flagrantly with the Law of Unintended Consequences.

--Dan

I admit that I hadn't thought of those aspects, which do make auto-acks somewhat less attractive.

(C/R systems that use URLs in email are apparently already in trouble, because allegedly at least some anti-spam systems fetch URLs in mail bodies to check the target page out. This strikes me as rather dangerous, and is apparently causing problems for things like mailman.)