“Not only is Microsoft transgressing an important norm here, but as far as I can tell, they also didn’t tell anyone about this or warn us in any way.”
Microsoft’s mail scanners now run JavaScript on linked pages and let it send POST requests. Single-use login and confirmation links get burned before the user ever clicks. Microsoft told nobody.