This is not correct. With Google now having Chrome and other tools, there are many ways for Google to find out a URL exists.

You may want to send a follow up email with a quick link for the user to add a noindex meta tag to the page, or even password protect it.