Send an email with Reply-To: [email protected] and go to jail!
That's not how it works. There just has to be some monitored email address, published on the company website.
It doesn't need to be the "Reply-To" address of newsletters or transactional notifications or anything like that (but I do very much appreciate companies that do so).
Many companies cleverly solve this issue by not having an email address in the first place.
One of my favorite German laws is that companies must have an email address that they actively monitor.
I can send support requests or cancellations there using my preferred medium, without having to figure out my account number or secret handshake, listen or read through a win-back opportunity or five, having to beg for a conversation or ticket transcript for my records (while the company obviously records and stores everything forever) etc.