From what I read, one key issue is to have a way to remove email addresses that bounce. In vB, you can set a Bounce Email Address, but the add-on to process those returned messages was never upgraded for vB 4. With our vB forum, we just manually move the member to an Inactive user group (we set it up as the equivalent to a non-member), and will restore their privileges when they let us know about it and, of course, confirm their identity.
We also use a vB product that sends notices to members who haven't posted in a while; it has an opt-out feature. Our newsletters (we use Dada Mail) have double opt-in and opt-out features, and it has a bounce manager too.
XF is basically set up same as vB as to a bounce email address. This would be a great idea for a plugin, to process the bounced messages.
Unless you have a really, really big board, though, you should be able to process the returned messages automatically.
But as to vB breaking spam laws, how does the failure to process bounced email cause a problem unless it's a huge number of emails? I can't see where a handful here and there makes a difference. As to sending out bogus emails, well, it doesn't matter what board system one has; that would be the fault of the owner of the board.