Have a look at RFC 2396 on "URI generic syntax" ( http://www.ietf.org/rfc/rfc2396.txt ):
-------SNIP-------
2.4.3. Excluded US-ASCII Characters
Although they are disallowed within the URI syntax, we include here a
description of those US-ASCII characters that have been excluded and
the reasons for their exclusion.
The control characters in the US-ASCII coded character set are not
used within a URI, both because they are non-printable and because
they are likely to be misinterpreted by some control mechanisms.
control = <US-ASCII coded characters 00-1F and 7F hexadecimal>
The space character is excluded because significant spaces may
disappear and insignificant spaces may be introduced when URI are
transcribed or typeset or subjected to the treatment of word-
processing programs. Whitespace is also used to delimit URI in many
contexts.
space = <US-ASCII coded character 20 hexadecimal>
The angle-bracket "<" and ">" and double-quote (") characters are
excluded because they are often used as the delimiters around URI in
text documents and protocol fields. The character "#" is excluded
because it is used to delimit a URI from a fragment identifier in URI
references (Section 4). The percent character "%" is excluded because
it is used for the encoding of escaped characters.
delims = "<" | ">" | "#" | "%" | <">
Other characters are excluded because gateways and other transport
agents are known to sometimes modify such characters, or they are
used as delimiters.
unwise = "{" | "}" | "|" | "\" | "^" | "[" | "]" | "`"
Data corresponding to excluded characters must be escaped in order to
be properly represented within a URI.
-------SNAP-------
The bottomline is that this is NOT a mail client bug but that the URLs in TYPO3 confirmation emails should be changed. The square brackets should be escaped to %5B and %5D.
For some mail clients (like Apple mail app) it also works to enclose the URLs in quotes or angle brackets (as Gregor proposed in his original report). Both delimiters result in correct links in Thunderbird and other email clients (like Apple mail app).
But IMHO the way to go is escaping as the RFC recommends.