How does a legitimate user clicking on a link inside an email generate a POST request?
It loads a page which then makes a POST request to an API via JS.
Thanks again for all the feedback. Short update:
I'm using DELETE now, since it feels a bit more accurate. As a side effect, the page is way more responsive. :)