Unsubscribe addresses with characters like + in them need to be url-encoded if they are going to be used in a query string. Not sure what the ? to & replacement was doing (was it broken?), but it is possible I broke something by removing it.