If we're getting technical:

CANSPAM doesn't cover account/privacy/ToS notices -- it's not a marketing message (falls into "other content").

I didn't "upload a mailing list manually" -- the emails are all attached to user records in my wholly-owned database. I send them from a queue on my own server, not through Mailgun's mailing list product (which queues a message to every email on the list instantly and doesn't allow you to ramp it up over time).

"Newsletter" is easier to type than "new content and product updates," but again -- these go out to existing customers and account holders. There's implied permission there from the fact that they signed up for an account. Opt-out is easy, and I don't feel guilty about emailing people who signed up for an account.

I would send this to the whole list if deliverability didn't go to hell after about 50k users (or maybe I just need to write better emails to keep people engaged/opening).

My reading was that he actually he HAD an opt-in/curated list just hadn't removed the bounces and other detritus the list had generated over time. I didn't get any impression that he was spamming people, the problems were all bounces gmail/yahoo "mark as spam".