I don't consider myself a CAN-SPAM Act expert, but you can go to the FTC's CAN-SPAM web page and read the requirements to be compliant:
http://www.ftc.gov/bcp/conline/pubs/buspubs/canspam.htm
Here's a rundown of the law's main provisions:
- It bans false or misleading header information.
- It prohibits deceptive subject lines.
- It requires that your email give recipients an opt-out method. You must provide a return email address or another Internet-based response mechanism that allows a recipient to ask you not to send future email messages to that email address, and you must honor the requests.
- It requires that commercial email be identified as an advertisement and include the sender's valid physical postal address.
The Act doesn't say anything about where you get the list of email addresses you send to. I don't see how emailing past customers could possibly violate this Act if you follow all the other requirements.