> * If the URL is personalized, it tells the attacker that the address is active. This is probably pretty limited help to the attacker. But it might tell them if your company emails follow a particular format, right?

I just asked chatgpt and it knows what email format the company I work for follows, so I'm not sure this is of particular value.