[DamonHD]

If those are to personal email addresses, they would be forbidden under GDPR (EU & UK) as not opt in and no right of deletion, ie misuse of personal data.

If they are coming to work (ie non-personal) email addresses then the employers could have some course of action, eg in the UK remove the implied right of access to email servers and then invoke the Computer Misuse Act for unauthorised use of those systems. I have eventually had some effects with variations of the second.

[thebiglebrewski]

This is to a personal email addresses. Yeah, I agree, I think they would at least have to give me a list of the 3rd parties? But I am in the US :(