This has absolutely picked up recently! It doesn't help their brand in my case, as I put them into the "Overly Aggressive Vendor" folder for future reference when I'm actually looking at purchasing services.

Those reply.io emails that look like they're from a real person are a grey area of marketing. I think it's deceptive and places undue social pressure to reply. Sometimes I do reply, but only when I get annoyed. In such cases, I turn the tables and start trying to sell them adventure travel (G Adventures). Sadly, we also use Criteo; thankfully adblockers block Tealium tag manager by default anyway.

When I saw OPs article screenshots, I actually suspected that Criteo had harvested the email address from the Forgot Your Password screen. This isn't uncommon – VE Interactive (I've mentioned them before), reads forms for email address fields and onBlur, they capture it and send marketing emails later. I _think_ this type of behaviour is supposed to be limited to cart abandonment situations, but I'll bet an incorrectly configured tag would target all forms.