Be careful before hitting ‘unsubscribe’—it might not just remove you from a list, but confirm you're a real target, say security experts.