LOL. She was counting on people's tendency to be lazy and just leave it in there. I'm an internet marketer by trade, and I know how people (re)act in certain cases.
In effect, (s)he was using the double opt-out approach, where it takes an ACTION to copy the link without the code, or an ACTION to click the link with the code, and then remove it from the input text field. Either way, the user would have to do something to protest / opt out. No action equals default opt-in.
Instead, if (s)he would have used the opt-in approach, then she would have provided a clean link, or no link, just a domain name. This would be followed by the optional referral code. The user would have to take an ACTION to opt in to the referral. No action equals default opt-out
As an I.M.er, I have to walk a fine line between genius and spammer. I believe true nefarious people now have access to our emails. I will have to create a new email address now, anyhow. But this person, was trying to cache in on the calamity by directly spamming their referral link to a laser-targeted audience. (And then has a donation address to boot)