Hi Toby,
It is because you don't use the escapeUrl function, which is mandatory.
But please, consider that it is not safe at all to expose in clear the recipient.email to the web, think to hackers exploits and spammers...
So you should either use an encrypted/hashed email (by using SHA256), or better, do as factory unsubscribe personalisation blocks do, using the
<%= escapeUrl(recipient.cryptedId)%>
or the equivalent:
<%= escapeUrl(reversibleCrypt(recipient.id)) %>
So Adobe Campaign does the link and it is security safe.
Regards
J-Serge