Threat model a bit different, they can just request xcancel.com/unique-string and check what IP or account requested unique-string IMO