GDPR requires newsletters (not talking about spam) to include unsubscribe links (or similar) in the mails they send. Those are most of the times in the mail body and also sometimes in the mail headers.
The unsubscribe link included a cookie in the URL which identified what is being unsusbscribed. Only the e-mail recipient would reasonably follow that link. And yet captcha in your face.