>The CAN SPAM act actually allows direct marketing email messages to be sent to anyone, without permission, until the recipient explicitly requests that they cease (opt-out).

Isn't this the root problem here? It is hard to see how you could even start to fix this sort of thing without fixing the spam law first.