GO Transit notification service fail

Here’s an interesting observation in regards to the GO notification service. The activation link they send in the activation email has the following format:

http://enews-gotransit.com/activate.aspx?em=name@domain.blah

Does this mean Eve can hack together a script that will sign up all of her address book contacts to receive notifications for all possible notifications and activate it for them too? I think so. #fail