I logged in after clicking the link...
What URL was in the email? Not where you ended up but what address was it going to?
Was it still pointing to Xbox.com or somewhere else?
If not, code was fake and you have to change your password
If yes, a douchebag stole your code