If you allow Outlook to render HTML (some email messages look like Web pages) some links can be automatically activated without your clicking on anything. This is true even if you only “preview” your messages.
One of the many precautions I've taken is to create an entry in my Windows Registry that prevents Outlook from rendering HTML. All the links are displayed as URLs but none is automatically invoked. There is no option to do this from the Outlook menu, you must set a switch in the Registry. Of course now I've forgotten how this is done but if there is interest, I might be able to hunt it down.