All working fine. Just back here to make a note about my experience and the reason for confusion.
I’m using Firefox and I rely extensively on its container mode where my default behaviour is that each tab is isolated from all others. Because cookies are private in this mode, a newly opened tab - such as happens automatically when I click a link from my Thunderbird email - gives me a fresh environment for browsing. I rely heavily on my password manager to avoid going crazy with logins.
What I did not initially notice when clicking the link that Discourse sent to my email was that the Firefox tab that opened was an exception to the rule I described above i.e. it was not a private tab and it shared the cookies with my most recent Discourse view (probably the youngest tab I was using when I triggered the email notification). So there wasn’t any Discourse magic going on, it is just a behaviour in Firefox Containers that I hadn’t experienced before.