And for the spammers: What matters for this is whether the recipient thought they opted in. No matter how clever you think you are by pre-checking that checkbox, or hiding it in the TOS, or putting the non-mandatory spam checkbox between two other clearly-mandatory checkboxes so people think it's mandatory: If the user didn't want the mails, they're going to mark your spam as spam and you'll have the deliverability problems that you deserve.

Totally agreed. Intent to opt in is what matters. If the box is pre-checked, it's opt-out. If it's hidden (in the ToS or elsewhere), it's opt-out.