what do you think they should be replaced with in that scenario? I could replace them with empty string but the label would still be there for "Not interested anymore?".

To me its no big deal that the token is visible in the  web page version, it isn't obtrusive and its obvious that it is out of context when viewed as a web page since it really is a newsletter viewed in a web page, people can't unsubscribe from there so other than replacing it with an empty string there isn't much else that can be done in terms of replacement.

I think there are far more important things for me to work on and it isn't likely I will work on that soon based on my current priorities.

Making the unsubscribe work from there would only be possible for authenticated site members anyway and it would not be possible for people who only signed up for the newsletter and are not site members because we don't know who they are when they visit the page nor would it work for site members unless they are signed in and if they are signed in they already can unsubscribe easily from their profile or from the newsletter email. So, even if I went to this effort unauthenticated visitors would still see the token and usually the vast majority of visitors to a site are not authenticated.

I could replace them with empty string easy enough.

That is an easy enough and reasonable suggestion, I'll do that and also I can do a simple check if the request is authenticated and if so instead of the replacing with the text message I can link to /eletter/default.aspx where an authenticated user can unsubscribe the same as they can on their profile.

Best,

Joe