@david--garciaWe have talked about this solution as well and I wanted to raise something that made us look a bit closer at the preferences use case.
In a lot of jurisdictions, when someone follows an unsubscribe link and unsubscribes (either automatically or by entering an email or clicking "Unsubscribe") you have to enact that change immediately and not provide some additional steps in order to unsubscribe (e.g. login, confirmation email, etc.)
If you require validation before making the change, you run the risk of the email not being received and the person not confirming it and you would fall afoul of the regulations in that country. It's worth checking the regulations in your client's area.
What I would do, is the reverse. Make the change in the database immediately, and send an email confirming like Google does - "If this was not you, then click this link to undo change" - that way you fulfil the regulatory obligations, but also give the user a chance to reverse the change if it was not done by the original recipient (or was done by accident)
Just my 2c
Cheers
Darren