Quarantine Direct Access.

There is a common group and we are part of it.

We received Daily Spam Report where hyper-link was there to access that email (Configuration - Options - Send Daily admin reports).

I was able to access quarantine without login and access email received on that group. Am I missing something here?

I believe, user should login to access quarantine. Is this expected?