I don't know if it could be abused, but passing in a currently-unused id will return a 500 status. Passing in the id of a user who has opted out will return a 404.