Prevent CC'd email addresses from being created as contacts

I’ve talked to HubSpot a few times about this issue and have brought up GDPR.

While I’m not sure how is it legal to collect and broadcast to European email adddresses where the recipient didn’t specifically approve, HubSpot acknowledged my concern but dismissed it (the customer service agent spoke to someone internally but either didn’t get or couldn’t provide a lot of feedback). Maybe it’s legal?