The post did not say it actually worked, only that he was able to see a different email address on the page. Did a clickthrough actually succeed for a different email address?
I tried it on my account, you get the confirmation that it has changed, but when I logged in it hadn't actually changed the setting. Perhaps one of the URL params is a token, CRC or hash of the email which ensures you need the correct values for the email you are changing.
Is this really that big of a deal? If it's a choice between allowing anyone to unsubscribe someone (low annoyance factor and rare) versus requiring that all users who wish to unsubscribe log in (annoying and possible can spam violation),then it makes sense to choose the latter.
I think people completely forget the CAN SPAM act. It really does enforce companies to make unsubscribing easy and accessible (ie no logins).