Hi,
This happens because you client has enabled autologin in the newsletter. It's much safer to not use this option and have the users manually login in by themselves. As you have noted the autologin link does not get removed once you forward an email that contains such a link. Since the forwarding is done from a local email client there's nothing we can do to prevent the autologin link from being forwarded.
First thing you can do is to add a RewriteRule to your htaccess that will strip the autoSubId from the requested url. That way you make the autologin impossible and you can put the site live again.
RewriteEngine On
# Remove 'autoSubId' parameter from URL's
RewriteCond %{QUERY_STRING} (^|&)autoSubId=[^&]*(&|$)
RewriteRule ^(.*)$ /$1? [R=302,L]
Once you have done this you can put your site back live again and the autologin doesn't work anymore. This gives you time to contact our support and ask them if htere is a way to reset these keys in Acymailing so the autologin link in the sent emails don't work anymore.
When you contact support, please make sure to inform them you have added the above RewriteRule to your htaccess, so they know the behaviour they can expect.
You can raise a support ticket here: https://www.acymailing.com/support
