I'm not entirely sure, but it seems like parsing the apache/nginx/other webserver access log is enough. When you detect request to some token ID, get email associated with it and send notification pre-recorded by the user.