Yet when I get a reset password email the exact same things happen... so for sites where that reset password is good enough it is also good enough to send auto login links.
Introducing some sort of security questions helps a bit, depending on implementation. Another idea would be to ask the user to create a temporary PIN, that is then used to sign the token, and is asked for again, when the user actually clicks the emailed link.
Lastly, users are more or less trained not to forward password reset emails. However, getting an email that says "Your stock is burning, click here to sell all." might cause the panic-stricken user to forward this email to his/her broker.