tl;dr: Microsoft and other email security scanners will visit the links in email you transmit, and run the JavaScript in those links, including calls that lead to POSTs going out. This used to be unacceptable, since POSTs have side effects. Yet here we are. This breaks even somewhat sophisticated single-use sign-on / email confirmation messages. Read on for how to deal with this, and some thoughts on how we should treat gatekeepers like Microsoft that can randomly break things & get away with it.

Aus Fefes Kommentar dazu:

Old and busted: Der “Antivirenschutz” klickt auf Links in euren Mails, um zu gucken, ob da Malware hinter ist.
New hotness: er löst auch POST-Requests aus.
Effekt: Wenn du Leuten Einmal-Links schickst, können sie nicht mehr auf den Link klicken, weil da schon jemand anderes draufgeklickt hat.