Thanks for posting this -- I've been getting email from companies that are requiring login to change email settings, but the inconvenience of getting spam is less of an inconvenience than tracking down my password for this random site. I've emailed saying that it was probably against a law, but I didn't know which law specifically.