The OP is not claiming that the link is being changed; the complaint is that a hyperlink is being generated from the plaintext URL. The HTML body of the email is being modified.

No-one said that link is a scam. But the next one could be.