...which means when the user clicks on the link in the
mail, they're not actually logged in, and so get an
error if anonymous users aren't allowed to view items
in the user class.

Here's the patch for 0.7.8's roundup/cgi/actions.py:

670c670
<         self.user = self.client.user =
self.db.user.get(self.userid, 'username')
---
>         self.client.user =
self.db.user.get(self.userid, 'username')