Email sending providers do not send a lot of emails on their own behalf – mostly they are just acting as a data processor on behalf of some other company. Such data processors are GDPR-compliant by following their controller's instructions, whereas controllers are responsible for deciding which data shall be processed, and for how long it shall be stored.
Opt-out lists and blocklists might be legally mandated in some regions, though it's largely unnecessary in the context of EU/UK laws like ePrivacy/PECR: you can only send marketing emails to natural persons that either gave their consent, or that are your own existing customers who were given an opportunity to opt-out when their address was collected.
Anonymous users can also visit all kind of marketing websites, and fill other people's email addresses.
This is why the industry best practice for email signup forms is double-opt-in: when you enter your email into a sign up form, you get one (1) email asking for confirmation. Only when you click the confirmation link or enter a confirmation code is your email address added to the mailing list. This procedure ensures that the recipient did in fact give consent. The GDPR requires that you implement “appropriate” measures to ensure compliance, meaning that industry best practices are effectively mandatory.
Even if a user asked to unsubscribe, those services will keep his email address in an "Unsubscribed Users" list.
As discussed, this should not be necessary in an EU/UK context. However, it doesn't necessarily violate data protection laws. As long as there is a clear legal basis for keeping this kind of data, it is legal. Such a legal basis might be the data controller's interest in demonstrating compliance (“yes we're definitely not sending any emails to those people”). It is also common to keep fingerprints of erased data in order to prevent the original data from being reinstated when systems are restored from a backup.
In any case, the GDPR's Art 17 right to erasure is far from absolute. It only applies under fairly narrow circumstances (e.g. the data was collected under consent, and consent was withdrawn), and contains a number of exceptions. The absolute right to object to marketing does not quite imply an absolute right to deletion if the data is still needed for other purposes.
those lists can even belong the EU citizens and maintained in remote locations (outside the EU).
GDPR does not care about the citizenship of data subjects. GDPR and related laws like ePrivacy/PECR will however apply when email campaigns are related to offering goods or services to people who are in Europe/UK.
The non-EU processing locations are a problem though. The GDPR allows international transfers of data if there are sufficient safeguards. Some countries like Japan, UK, or Canada have been granted an adequacy decision, allowing transfers to continue without additional hurdles. But things are very difficult for transfers into the US: the Schrems II decision struct down the “Privacy Shield” adequacy decision, and alternative transfer mechanisms like Standard Contractual Clauses might not be effective due to problematic US spy laws. Unfortunately, many email sending providers do process data in the US. It is likely that data processing activities involving such US-based providers cannot be GDPR-compliant.
What if I want to create a service that does let users enter their friends' email addresses, and send those friends an email invitation to the service?
Such a service might not be compliant with European laws (ePrivacy/PECR/GDPR). The UK ICO warns in their guidance on electronic mail marketing:
Another form of viral marketing is to ask people to provide their friends’ contact details. However, you must still ensure that any marketing messages you send to those friends comply with PECR. This may be difficult, as you cannot be sure whether the friends actually agreed to give you their details. We would therefore advise against this type of viral marketing.
Remember the criteria mentioned above: if the emails contain marketing, you need the recipient's consent or they already have to be your own customers (and they didn't opt out). An “invitation to the service” sounds very much like marketing. It only makes sense to invite people that aren't already members of the service. You can't obtain consent without prior contact, and wouldn't be able to demonstrate that you have already received consent (compare Art 7(1) GDPR). Thus, you cannot send such invitations, or cause such invitations to be sent on your behalf.
