OK, well, that's... Actually worse.

Websites should not make changes to a user's settings based simply on a GET against an URL, because the user can click the URL from a random stranger not knowing it would have that effect -- as I did.

Aside from being a poor user experience, what has happened here is someone has deliberately coded a security vulnerability. Granted the impact here is basically trivial, but it's still a pretty classic no-no, and should have immediately set off flashing lights and klaxons in any security-conscious developer's mind.