[nly]

You can defend against this a little bit by having the magic link load a page with a button (which submits a POST action) that you have to click.