I agree with @calmh
Worrying about forwarded unsubscribe links is an imagineered problem that does not even happen at facebook scale.
I can imagineer solutions for it if needed:
-
check that the IP of the person trying to unsubscribe matches the locations they previously logged in from, if not send a confirm
-
if happens within N minutes from sending the link, send a confirm
But before building complex pyramids here, lets confirm this is a real problem. Aka have say 10 examples in the wild of a malicious “forward unsubscribe”
My gut tells me that since this not a problem for facebook or hundreds of thousands of sites that just let you plug in a random email and unsubscribe it with no confirm… its probably not going to be a problem here.