A Commerce Clause challenge would fail
A Commerce Clause challenge seems like a sure loser. Under the Commerce Clause, Congress “has authority to regulate and protect the instrumentalities of interstate commerce,” Gonzales v. Raich, 545 U.S. 1, 16 (2005).
Because “the Internet is an instrumentality and channel of interstate commerce” United States v. MacEwan, 445 F.3d 237, 245 (3d Cir. 2006), Congress has virtually boundless authority to regulate its use. Gibbons v. Ogden, 22 U.S. 1, 196 (1824) (“This power, like all others vested in Congress, is complete in itself, may be exercised to its utmost extent, and acknowledges no limitations, other than are prescribed in the constitution.”)
A First Amendment challenge would probably fail
But as you note, that authority is not boundless, as congressional enactments must still comport with the First Amendment. I would not be surprised by a First Amendment challenge to such a law, but I think it would fail.
Commercial speech enjoys less protection than speech by individuals. For instance, although the government may not limit speech merely because it concerns unlawful activity (Brandenburg v. Ohio, 395 U.S. 444, (1969)) or because it is false (United States v. Alvarez, 132 S. Ct. 2537, (2012)).
But commercial speech is essentially unprotected by the First Amendment unless it concerns lawful activity and is not misleading. Central Hudson Gas Elec. v. Public Serv. Comm'n, 447 U.S. 557, 563 (1980). And even then, the government has wide latitude to compel commercial speech, as opposed to restricting it:
Because the extension of First Amendment protection to commercial speech is justified principally by the value to consumers of the information such speech provides ... appellant's constitutionally protected interest in not providing any particular factual information in his advertising is minimal. Thus, in virtually all our commercial speech decisions to date, we have emphasized that because disclosure requirements trench much more narrowly on an advertiser's interests than do flat prohibitions on speech, warnings or disclaimers might be appropriately required in order to dissipate the possibility of consumer confusion or deception."
Zauderer v. Office of Disciplinary Counsel, 471 U.S. 626, 651 (1985).
There are, of course, still limits on the government's authority to compel speech, and the Supreme Court has struck down compelled commercial disclosures that did not deal with "purely factual and uncontroversial information" and did not relate "to the services that [speakers] provide." Nat'l Inst. of Family & Life Advocates v. Becerra, 138 S. Ct. 2361, 2372 (2018)
It's unclear whether a disclosure law must satisfy both parts of that test or only one. If it's only one, an e-mail chain of custody seems sufficiently factual and uncontroversial to survive a First Amendment challenge. If the law has to pass both tests, it would likely come down to the question of whether that chain of custody bears a significant enough relationship to the speaker's services. I can imagine arguments both ways.
The states may not impose new limits on spam e-mails.
Although the federal government could enforce this law, a state government could not.
The CAN-SPAM Act of 2003 sets baseline rules for unsolicited commercial e-mail and permits the Federal Trade Commission to further regulate those messages. Although many people think those laws don't go far enough, the states are generally not permitted to enact any further regulations, because they are expressly pre-empted by 15 U.S.C. § 7707 (“This chapter supersedes any statute, regulation, or rule of a State or political subdivision of a State that expressly regulates the use of electronic mail to send commercial messages”).
There are two exceptions to this pre-emption. One permits additional state regulations addressing deceptive communications, and another permits additional state regulations that only incidentally effect e-mail messages. The first option seems weak, but perhaps a state could enact a law requiring any commercial solicitation -- regardless of medium -- to require such a chain of custody. I'd imagine, though, that the most common alternate means of sending such messages (fax, USPS, text message) are also regulated by federal laws that likewise pre-empt state regulation, so I think this could be difficult to pull off as well.
tl;dr: The federal government would likely be permitted to impose this law, but a state could not.
+
character, asserting - incorrectly - that such addresses are invalid.)