Why do you need a token at all?<br>
What's wrong with `https://list.example.com/unsubscribe?address={email_address}` on its own? 

To prevent [user ennumeration attacks](https://www.rapid7.com/blog/post/2017/06/15/about-user-enumeration/) that might reveal if somebody is subscribed, make the server's response more vague (see that link).

I see no concern in "malicious" unsubscribe actions (unless this is some kind of critical system, in which case: maybe you shouldn't be using email? Otherwise, consider [2FA](https://en.wikipedia.org/wiki/Multi-factor_authentication "multi-factor authentication")). I think the easiest accidental unsubscribe comes from forwarded emails, in which case the presence of an auth token doesn't actually help (but 2FA does).

(If you're more interested in the cryptographic soundness of that concept, I suggest asking [Cryptography Stack Exchange](https://crypto.stackexchange.com/) instead.)