A small point, but your API doesn't appear to use any kind of authentication/authorization: $handle = fopen("$sendy_url/subscribe/$sendy_email/$sendy_list/".st

A small point, but your API doesn't appear to use any kind of authentication/authorization: $handle = fopen("$sendy_url/subscribe/$sendy_email/$sendy_list/".str_replace(' ', '%20', $sendy_name).'/true', "r");`). In theory, anyone who knows you are using Sendy (I'll assume looking at the headers in the emails sent would reveal that) could subscribe/unsubscribe any email address and possibly wreak havoc. You should secure that somehow: either an authorization scheme or a secret or SOMETHING.