Ah, but the user is "clicking a link in the email". It just is an "automated click". The danger in "clicking a link in the email" does not come from the physical action of pushing the button, but from the downloading of data from a link found in the email. If this downloading occurs automatically, the risk is not reduced; quite the contrary, in fact. Most emailing software offer, at least as an option, a possibility not to automatically download pictures; this is an improvement because it, at least, gives a way for the user to prevent the download to occur (namely, by not clicking).
In that sense, your proposal is equivalent to a click-in-email system, and shares the same security issues. At best, it improves user experience, in that it removes the physical click in the cases where the user is careless (i.e. his software follows image links automatically). To some extent, what you suggest boils down to: "yeah, user is vulnerable, but at least we can leverage his vulnerability to make his life easier; he cannot be protected, but let's fill his world with blissful ignorance instead of dread".
Now, if you take the server's point of view, the system indeed guarantees that whoever received the cookie in his Web browser is also able to read the emails sent to the specified address, since the browser followed the image link from the email. You should still make sure that the link in the email contains a non-guessable random component; otherwise, an attacker could simply get the picture by typing the link in his browser, thus simulating reception of the email. As usual, even the best security systems contain enough room to totally botch them, if implemented without due care.
