Article aside, it's much better to have a one-click unsubscribe that just works. It's an edge case that someone will unsubscribe from someone else's mailing list or click it by mistake, so making every single person (99% who are unsubscribing on purpose) confirm, log in, enter their address or receive a confirmation is an infuriating waste of time. The best way to mitigate this is a simple "You unsubscribed whatever@…
If you are in the USA, it is also illegal. The CAN-SPAM Act[0] specifies that you can't ask the user for more than their email address[1]:
> "You can’t charge a fee, require the recipient to give you any personally identifying information beyond an email address, or make the recipient take any step other than sending a reply email or visiting a single page on an Internet website as a condition for honoring an opt-out request."
See also previous thread on HN[2]
[0] http://en.wikipedia.org/wiki/CAN-SPAM_Act_of_2003
[1] Point 6: http://business.ftc.gov/documents/bus61-can-spam-act-complia...