CAN-SPAM does not make spam (unsolicited email) illegal, it simply sets parameters for what's allowed and not. That's why, back in the day, we called it the "yes companies CAN go ahead and SPAM everyone" law, playing on the double meaning of 'can'.