`$link` is passed to the URL, and thereby an attacker can use the link without access to the e-mail address. This is a security issue.