I'd be curious to know how one could do "due diligence" on the size and activity of a private email list. Does that mean contacting people who have advertised in that newsletter before and hoping they share with you their results?
Yes, emailing third parties for social proof is one way to go about it.
Then there's contacting the newsletter directly for proof of their actual numbers by making available current and previous month's screen shots of MailChimp campaign reports, for instance.
And as pixelfeeder mentioned, they'll also gather their own internal analytics based on how money changes hands on Upstart.