Strictly speaking the email provider should have simply provided an Unsubscribe function which your colleague would click should he/she so wish.
He/she actually having to send an email to request the removal of her details is a crime worthy of a jail sentence - death post GDPR.