Completely agree, Match.com does the same thing. Not so long ago a user signed up to their site using my email address (never figured out why).<p>They were able to create an account and subscribe to the site without ever verifying the email, so for a week or so I was getting notifications sent to me without any way to unsubscribe from the email.<p>Clicking any of the links in the email signed me in as the user and gave me full access to their account and billing information. I ended up going into their account and turning off all email notifications to make the emails stop.<p>Edit: Just checked my trash folder and an email sent on the 8th of August still contained valid login keys to access the account.