and by doing that you confirm a 'live' email address
In fact you don't, because you're not responding by email, you're clicking on a link that goes to a fake website. I doubt if they can tie that up to the email address to which they sent the email, and even if they could, what would be the point?