The emails were sent to websites that do not process personal information and are thus not subject to GDPR, so the recipients were in some cases confused about what their responsibilities would be. And though the emails did not suggest that legal action was pending, they do suggest a willingness to resort to legal action in a relatively short time frame. This caused anxiety for apparently many small-time, non-profit bloggers.

Is it unethical? I dunno. But it's nuanced, at least.