You are correct: Unsolicited email
from any commercial entity with which the recipient has no previous or current business relationship is considered a violation of the CAN-SPAM Act of 2003. But as a professional e-marketer, you already knew that. Right?
I agree it was dumb to hand over the email list to her. Even though you did so in good faith, she did not receive it likewise.
Since email addresses are digital in nature, there is nothing to "hand over". And prohibiting her and her new band from using the list any more is pretty pointless - unless you've got thousands of dollars and months of free time with which to pursue a lawsuit.
That leaves two options, IMO:
1) Leave the situation be. Move on. Chalk it up to experience. Learn a valuable lesson about trust - under what circumstances to trust...and
not to trust.
2) Quickly send out a blast to every person on your list. Very briefly and succinctly explain that old singer + new band are using your email list without authorization. Apologize for any inconvenience on the part of your recipients,
make it very clear that it did NOT come from you, and invite them to block or blacklist all subsequent email from the offending party. THEN, move on.
Personally, I would be inclined to follow Option #2...
As you probably know, a fresh, clean email list, properly groomed, cultivated and qualified, is worth A LOT. Enough so that you may even wish to defend it after the fact. Essentially, you want to prevent your recipients from suddenly getting overloaded and burned out with "band email", lest they somehow confuse your band with the old singer and
her band. Especially if there's any way in which it could ultimately could come back around to bite YOU.
MM