-
Seems to be a few options;
If the "Unsubscribe" page is requested via HTTP GET, it renders a simple confirmation form and a bit of JS that submits the form on page load
If the "Unsubscribe" page is requested via HTTP POST then we unsubscribe the userOr, add a timer so that any immediate clicks (within 5 minutes of the send, say) return a captcha or something.
Probably more elegant ways. But it will be up to the big marketing email providers to work that out.
How do you implement those? Many years ago I ran a list which had a one click unsubscribe link and some people kept unsubscribing. It turned out they had some anti-malware service which was opening all links in the email to see if they were malicious, including the unsubscribe link.