It depends - what's the purpose of the mailing list? If it's for purely personal or household purposes (e.g. a group of friends/family) then it's out of scope by virtue of Article 2(2)(c). Otherwise it'd likely be in scope with the list admin being the data controller.

GDPR article 2(2)c. It will not apply to the receiver of the email, but maybe to the provider. Perhaps it depends on the kind of relationship between the two parties. Mailing lists will be covered.

Side note: I know someone who requested their data to their DPA, and part of the response contained emails mentioning them and their complaints in the _content_ of the message (they were not in the From:, To:, Cc:, or Cci: fields). All names and emails address were censored, though, in accordance with 15(4).