Someone should sign up for all the mailing lists with a email address used nowhere else and track the cross-mailings. Maybe a bubble babble hash of the company name as the email prefix, and a big mailer like gmail or protonmail as the server. When the email is leaked and the company does not inform the user, report the company via GDPR.