[yxhuvud]

Personally I would have

1: Added a users resource beneath the mailing list, ie

  resources :users
  resources :mailing_lists do 
    resources :users
  end

add_foo is almost always a sign that a new nested controller should be made, and there is almost always a need for a delete as well - in this case users should be able to remove themselves from a mailing list.

2: Put the add method on the mailing list and not on the user, because that is where I'd expect the least logic to be.

because:

3: I'd put the actual mailing list mailer logic in a separate class for the configuration of it.