In addition to the header info mentioned in other comments, email providers let you subscribe to email Feed Back Loops. You register for FBLs (man it's a neverending process since there's a never ending pile of new email providers), and when someone marks something as spam, the email provider (gmail/outlook/etc) will send an email to a registered address, you just listen for emails on that address. I wrote a custom handler to do this, as we already had a system in place to process incoming email from users (respond to comment email instead of replying on web form etc). I then unsubscribe the address in question.

Not all providers offer FBLs, in that case my internet provider gets an abuse notice which is forwarded along to me. Not a ton of activity there on a 500k person mailing list, the FBLs are pretty effective.

Also, since we have the email processing system in place, it's easy to detect bounces and auto unsubscribe people. I immediately unsubscribe on a hard bounce, and wait for 5 soft bounces before doing the same thing.

You can include a header in your email message where, if a user marks a message as spam, Gmail / Hotmail / whatever will let you know.

Why do they do that? Seems great for this use-case but terrible information to give bad actors.

When I've usually clicked the report spam and unsubscribe button after reporting spam in gmail it usually immediately opens a tab with the unsubscribe URL.

I've since stopped doing it since the last thing I want to do is open up some random page belonging to the person who spammed me.

That's strange. I thought the point of that button was to overcome the exact problem you just described.

Tried it again with a different message and they said they'd try to unsubscribe me this time instead of opening a link.

Did try again yesterday with a different spam message and had it open a tab though; Zapier was spamming me with some newsletter so I clicked "Report Spam and Unsubcribe" yesterday and it opened up this in a new tab: https://zapier.com/app/settings/email?payload=REMOVED

Not really sure how it determines that -- I'll probably avoid clicking it just out of precaution and just report spam going forward though.

Using a lot of the privacy and security measures suggested in https://www.privacytools.io/ I sometimes do a gmail search using 'is:unread in:all unsubscribe' and click on most of the links I can find.

In some cases, Gmail automatically detects the unsubscribe link. If you click Gmail's unsubscribe link, it may give you a pop-up or it may automatically write an email to [email protected]. The pop-up usually leads to a form that you have to fill to 'update your newsletter preferences'.

What information does this reveal besides your email address, which they clearly already have?

It's a feedback signal showing success at passing automated spam filters.

It confirms that the address is valid, and most likely attended by a real person.

But there are gazillion email leaks. Go scrape them all with hashed passwords. Active emails have no value.

Leaks may have emails that are defunct, belong to dormant accounts nobody reads, throwaway accounts like mailinator.com, honeypots, etc. This confirms the account belongs to a real human actively reading the email.

You're right that they don't have value but there's still plenty of idiots out there buying and selling useless lists and while they're worthless they have a cost to us as recipients since we have to mark them as spam and delete them.

It reveals that their email was detected as spam by an intelligent piece of meat instead of a shard of silicon.

Email lists with verified activity have a higher success rate and sell for more.

Many times when you hit the spam button, gmail ask if you want to "only mark as spam" or "mark as spam & unsubscribe".

Would make sense to prevent themselves to be marked as spam in the future.

idk, I'm trying to find a way a bad actor could take advantage of that information. Kind of helpful for spammers to get a sense of what does and does not get marked, but they can just see how many people clicked the link.

In the past (10+ years ago), clicking the Unsubscribe link in a spam email was a sure way to get your email address sold to every spammer out there.

Most of those bad actors seem to have been weeded out, but some still might try it.

In the comments, they explain that Sendgrid gets notified of spam marks, and Sendgrid gives SO a webhook whenever someone marks as spam. So they then unsubscribe that user.

They probably assume if you make as spam, you will also be unresponsive to the email. If you are responsive they can say that overrides the marking as spam action.

See the List-Unsubscribe mail header.