Scenario: Forum account registrations, user must click an activation email after they sign up e.g. they create an account with username, email, password, and an email is sent to the email they select. They must click it to "activate" the account.
Lets assume that all steps up to the clicking of the email are secure for the use case/purpose of the site.
I understand that the users email account could be compromised, but this is not in our control.
What security issues are present in the scenario that we auto-log the user in when they click the activation link in the email (and activation is successful)?
I have read the answers in the question Logging in a user after password reset via link, and it seems the strongest reason for NOT auto-logging the user in would be those mentioned by Tom Leek e.g. user not knowing they are logged in automatically, and potentially leaving the device unattended with an authenticated session still open, etc.