My school in fact had my contact details from way before GDPR was a thing. Recently, they were forced to write to confirm that they were allowed to continue contacting me. If I had not responded, they would be compelled to delete my information.
So if I'd missed the message, I would unknowingly be disconnected from further communications.
And what is to be gained from this? All the risks of someone hacking the school system are the same, someone could still spam everyone, and so on. Why not just have an opt-out system, defaulting to stay-on-the-list? Then people who care to be removed can do so, but we can assume quite confidently that most alumni of a school want to remain in contact.
It just smells like someone had a use case they were thinking of that perhaps made sense to have a default-remove, but they ended up imposing it on everyone.