The list is defined by the getYears() method in Mage_Payment_Model_Config (app/code/core/Mage/Payment/Model/Config.php).
Here’s how you get from $years = $this->_getConfig()->getYears() to that:
$this is the current class (Mage_Payment_Block_Form_Cc) which has a method _getConfig(). All _getConfig() does is return Mage::getSingleton(’payment/config’)
Mage::getSingleton(’payment/config’) gets you an object of type Mage_Payment_Model_Config (/app/code/core/Mage/Payment/Model/Config.php). So all you need to do is open that class and look for the method getYears(), which as it turns out, returns the next 10 years including the current one.
From here you can follow the easy, wrong path and just change that method in the core file, or the harder, but right path and override the method in a module of your own.