I’ve been doing some more research on this, and wow, the more I dig into email the more complicated it becomes! Apparently, there are lots of email security scanners that crawl the links with a GET request and cause this to happen. and the suggestion is to limit the remove me functionality to only POST requests. Something like:
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
But you’d have to send the user to another page with a form that submits the unsubscribe by a POST request.