I could be mistaken, but I believe Cloudflare doesn’t allow second-level subdomains on their free plan

Yes, there are many different ways you can accomplish this.

I would be more interested in an smtp relay service like ghettosmtp which could tunnel through CGNAT.

I don’t think so. (I’ve asked about this on Cloudflare’s forum in the past.) You can host a mail server at home, but not through a Cloudflare tunnel. A domain’s MX record for its mail server must point to an A or AAAA record, but a Cloudflare tunnel can only be specified using a CNAME record.