Even though I am not aware of an explicit exploit, I would draw a different conclusion. Anything that is security related should expire, because you can not know what will be possible in the future and because a token is a form of credential.
Here are some more reasons I would take into consideration, other than the (personal) backup.
Most important, reusing an old token would be complete non-detectable for the legitimate user. If the attacker must send a new token, at least the user has a chance to get a new mail notification etc. (I am aware of at least one real incident where a user has informed the IT department because of suspicious notifications on their phone for mails they could not find in the inbox - the attacker delete the mail right after they copied the data needed).
Mail is usually stored and forwarded a lot between servers. Thus besides the personal backup you need to consider that the the mail was at some time stored on any of the involved mail servers, maybe even backuped.
Your mail has passed most likely through several spam filters along the way and this be process by systems you might not be aware of.
Someone might have recorded a LAN/WIFI transmission where your mail was not encrypted (plain SMTP).
Once used, the link can show up in the browser history, even synced to other devices as well.
So while it seems to be hard for an attacker to target a specific user through old emails, there are still several attack vectors for abuse of the token for any user of your system.
In the end, you will have to check it against your threat model.