It may very well be illegal.

Notify their support staff. Then mark the messages as spam with your email client.

It's probably "legal" in some locales, but it probably shouldn't be. I've noticed this anti-pattern with some other entities.

Every single unsolicited email should have a single click unsubscribe link at the bottom.

Settings/account is where you adjust them in my test tenant. If you subscribe to the service and they communicate updates to your registered email how would that be spam?