> Broad did not locate the Oct. 2023 Notice until January 2024, when she affirmatively searched for the email and found it in her spam folder.
I think it's rather relevant that she affirmatively searched for and found the email?
Statistically speaking, most people use one of the biggest email providers, which use their own models to detect spam (or even quietly drop messages). If you're doing an unpopular TOS change, why not set the mail up to still be RFC compliant but in such a way where the mail isn't going to be allowed through by any of the providers. Then you can just claim the problem is userside.
For example, the Message-ID header is technically not required (SHOULD rather than MUST), but as a spam detection measure, Gmail just drops the message entirely for workspace domains: https://news.ycombinator.com/item?id=46989217
Spam categorization isn't a delivery issue. The delivery is the same whether you, upon taking delivery, toss the message into a bin labeled "spam" or one labeled "inbox".
Even if you are OK with the idea that a user can be presented updated TOS with no option to disagree (I don't, but put that aside for a moment), it should still require a mechanism that actually guarantees (or at least verifies) that the user has seen that the terms are updated. Email is not that. (An unskippable notice on login to a web service would be.)