I'd probably keep the bug tracker public, make it the place for filing bugs, and immediately copy & paste any bugs reported via other means into a new tracked b

I'd probably keep the bug tracker public, make it the place for filing bugs, and immediately copy & paste any bugs reported via other means into a new tracked bug, and reply with the URL for that bug. Bug tracking in a mailing list is messy, especially if that list is also used for general discussion.