That's a fair point. I didn't realize they embedded login links, unless you explicitly do something.

For example with now.sh/Vercel: https://vercel.com/login?with-email=1

I'll probably create rules that sends a blacklist of emails to the trash and warns the user.