> one of them is security scanning software potentially visiting the link. I gave it some thought, and that seems to be solvable. Have the link go to a 'confir

> one of them is security scanning software potentially visiting the link. I gave it some thought, and that seems to be solvable. Have the link go to a 'confirm' page, where the confirm button performs a post request. If security scanning software is randomly hitting post requests, that is just totally ridiculous. What seems a lot more scary to me is the plaintext nature of e-mail. Even SMTP over TLS doesn't keep any end-points from reading your email, and I'm guessing there is a small but significant set of people who'se email providers don't run TLS. Besides, if someone can recognize that any request is underway for a login, they might intercept it and send a phishing fake.