I think it's less for tracking than for trying to combat viruses and phishing attempts. Having the spool data and writing the JavaScript mail client app makes link-based tracking redundant.