IANAL, but not very much. It literally just prevents you from waiving your rights to legal action by any other means.
Now, with the very minor legal education I recieved, none of which makes me a lawyer, if someone impersonated you there's no real contract. There's certainly no meeting of the minds. You can literally go "Hey, I did not send that!" and while it's a hassle, if you both want arbitration, there should be no issue.
It's literally a very contrived scenario, more likely to cause a inadvertant DOS attack on the SE helpdesk system, rather than a spate of wrongful opt outs.
For this to work, the attacker would need the email addresses of the victims (and that's not publicly available), spoof their email, and hope they ignore any reply from SE.
In a sense for this to work there would need to be a distressingly large data breach at SE, or a rogue site mod would be needed.
SE would then need to blindly process these — ignoring the fact that the email was sent from another server. As someone who's run his own email server in the past, due to the sheer number of people abusing emails, it's less trivial to spoof emails, especially from well known domains than it used to be.
There's probably simpler ways to muck things up.