If ActBlue doesn’t want at least moral culpability for causing that type of outcome, they should do what they can to stop it in the future, even though everything you wrote in your post is accurate.
The inability to minimize spam resulting from my donations is the one and only reason I don’t donate. I would happily donate if I had a way to limit the responses to a confirmatory thank-you message and nothing else. Even the alumni relations department for the university I attended allowed me to express my contact preferences once years ago, and they’ve respected that ever since. But not US politicians.
By contrast, the one time I made a Canadian political donation - I was then a Canadian permanent resident and am now a US-Canadian dual citizen - I was able to do so over the phone, and including declining to give an email address and requesting not to be contacted or added to mailing lists. Much better. But even there, I would donate more if I were able to do so online without being spammed.
So, while it’s true that ActBlue isn’t selling data to other campaigns, it’s still enabling that sale without doing what it can to respect donors’ privacy and desire for control over the email inbox.