A website, can just be a URL of, well... nothing. As long a web server is sitting there logging the requests. spammer.douch.nozzle/collect_request/JoeShmo_1x

A website, can just be a URL of, well... nothing. As long a web server is sitting there logging the requests. spammer.douch.nozzle/collect_request/JoeShmo_1x1-transparent-UUID_0se9a009fjwljwlfl2f.gif but all the info the douch needs is in the "UUID", the rest is easily obfuscated. If your email client renders renders images willy nilly, the image is enough to confirm a valid target (clicking "unsubscribe" isn't necessary to become victim but is a hard lock-in mechanism (A human is on the hook...)).