The ddg browser part is simple to explain: you followed a link that was generated specifically for this email sent to you. When you click it fb knows who you are (so they directly log you in), but also that you reacted to this specific clickbait campaign.
Expect more trash from them since it worked once.