If it's discovered that staff Leave Approval is occurring automatically without the staff interacting with the authorization email, it's likely that an adjustment in your email spam filter procedure is the most likely cause, in particular a more aggressive testing of received emails. It is most likely now scanning the emails and safety testing any action hyperlinks. In this case, the Approved button in your email is being tested, and hence actioned.
To prevent automatic actioning of the approval button in Leave Authorization emails, updating the System Configuration setting #2624 Require Confirmation for Leave Authorization (found in the Leave General section) will change the workflow slightly. It will add an additional set and require a confirmation for leave authorization emails. This will prevent spam filters from auto actioning the approval button upon delivery of the email to your staffs' inbox.
The setting