That's a fair point. I didn't realize they embedded login links, unless you explicitly do something.

For example with now.sh/Vercel: https://vercel.com/login?with-email=1

I'll probably create rules that sends a blacklist of emails to the trash and warns the user.

Depends on the implementation, at $WORK we have similar mechanism but the links clicked in the email do what's called a partial login that gives basic access to some closed pages but still needs authentication to access or change account details. We have this exactly because people forward emails and such.