Everything is safe.
I've contacted GitHub support about this, and this is their answer:
I've confirmed with our notifications team that the email_token parameter is not sensitive nor poses any security risk. The token is just used for tracking clicks in our notification emails.
I've opened an issue with our team to see if we can tidy these email replies up a bit as I can understand seeing a "token" inserted into comments is worrying!