Could anyone solve this mystery?
We have an web application that is only available to invited users. Our admin create accounts for users, and then the application sends an activation email to that person. The email contains a link for them to click in order to activate their account and then set a password. The link contains a unique reference, and once the link has been accessed once, it is no longer available.
One person reported that they received their email, but when they clicked their link, they got a 404 error - meaning their link had already been accessed. On searching the server logs, we saw a request matching their unique link many hours before they said that they'd clicked the link. In fact, the request occurred as soon as this person's activation email was sent, but before it reached our user's inbox. The WHOIS records for the IP address of the request - 18.104.22.168 - says it is server in the USA belonging to Packet Exchange, whereas our user is in the UK.
Does anyone have any ideas how this could happen? Could some sort of email-filtering program be accessing links in email messages whilst they are being routed around the web? Or could it be something more sinister?
This has only happened with this one user, many others have activated their accounts without problems.
Our emails are sent via MailGun, if this makes any difference.