Someone used my email to sign up for a Bank of America account. B of A doesn't do anything to verify ownership of emails used to create an account with them. They claim it wouldn't be possible, since people often make accounts in a branch.

There is no way to unsubscribe from the emails they send. So if someone who used your email keeps requesting account balances because they're not getting the emails, you just get a ton of them.

And so you might call B of A and say "Hey, this is actually a violation of CAN SPAM." They'll argue with you that it isn't. You might send and email to your states attorney general who says they'll look into it.

Once you forward that email to B of A, they might get kinda nervous. They might call to ask what the email address is. You might suggest that maybe they should send an email to every customer they have, to make sure they don't just solve one isolated case. They'll say they're not going to do that.

If you then ask to record them making that statement, they'll say they're not allowed to continue the call if you're recording it. You might point out that both of you are in one-party consent states, and you're actually not required to tell them you're recording it.
If you did that, they might just hang up on you.

They might just call you back the next day to talk about it again. If you point out the irony of them announcing they're recording the call, but you're not allowed to, they won't find it very funny. If you tell them that the policy seems patently anti-consumer, they might hang up on you again.

You might get a very apologetic call from a VP a week later. They might apologize profusely for handling things poorly. You might ask them what they plan to do about those issues, and they might not plan to take any action at all.