[giantfrog]

Still seems far, far more likely that the average user will have their account stolen via password theft/reuse than the more complicated scheme the author is describing. Links instead of codes also fixes the issue.

[esseph]

Links are not trustworthy and can leak to compromise.

[esseph]

*lead, oops!