I investigated our web logs because one of our organizations reported what seemed like strangely inflated click through numbers, including a lot of click throughs reported the very minute the message was sent.
The web logs confirmed the statistics that CiviCRM had in the mailing report.
However, I noticed that many of the IP addresses looked like they were coming from the same block. A whois search revealed that they were all IP addresses that belonged to the Anti-virus vendor Barracuda.
I can't be 100% sure, but it looks to me like many of the recipients may be using Barracuda software, which may be automatically reading the messages and then "clicking" through all links in the messages to ensure they don't go to any phishing sites.
If this theory is correct, then we may be saying good bye to click throughs as a useful metric, which is a shame since "opens" are also pretty worthless (although barracuda does not seem to be downloading the open img).
Any suggestions on how to avoid this problem? We could exclude barracuda IP addresses but that seems like a losing battle if this approach becomes widespread.