For the same reasons any web method which takes an action, rather than merely returning information, should require POST. An attacker cannot in this case steal secrets etc., but he could perhaps cause a denial of service. And there could be accidental problems from link prefetching, cache refreshing, etc.