[ydant]

That has the problem of opening up an attack where the attacker requests the sign-in link, the person receiving the link blindly clicks it, and the attacker now has access.

People blindly click links all the time. It would have a low success rate, but would be more than 0%.