How is making money from stolen data legal? My email address is in the database and I never consented to it. Is there no legal repercussion?