> what if malicious bots started unsubscring thousands of email addresses to harm your business.
GP said:
>> need to confirm that a user "looks human" is for repeated connection attempts in quick enough succession to matter (DDoS prevention)
And even in that case, you could implement other solutions. For example, for unsubscription links, you could pass a "token" in the query string that "verifies" that it's the address' owner unsubscribing. You could generate such token either stateless (JWT, for example, then verify it) or store it somewhere along with the address.
