They create these POST requests by tricking the user into opening a malicious web page or email that they control. From that page they use JavaScript, I presume

They create these POST requests by tricking the user into opening a malicious web page or email that they control. From that page they use JavaScript, I presume, to send a POST to the target website and monitor the packets by eavesdropping on the encrypted data upstream from the user. So I suspect that having JavaScript disabled by default on untrusted domains would be a decent safeguard against this.