So are they looking for an open standard type method of double opt-in?
In other words, will a Marketo DIY approach satisfy spamhaus?
Any approach that prevents anonymous "subscription slamming" would be okay.
I shouldn't be able to sign someone else up for your newsletter if I can't access either their incoming email or some other form of separately vetted contact like phone/SMS. Email confirmation link and a required Marketo Click Email activity is the most straightforward way, but if you had some way of knowing their phone number was really theirs (like, say, if Sales called their corporate main number) that would work too.