It's also that they had insufficient recording of how consent was given (which GDPR was stricter on).

So lots of firms, including some I've worked with, have huge mailing lists with addresses from multiple sources and are _pretty sure_ they got consent in all of those cases, but have no way of showing that if asked.