Possibly your email client clicked that for you. This is actually a legitimate concern because some exploits work that way. Doesn't change that its a bug you got fingered for that tho.