For an email to be marked as 'open', a tracking pixel needs to be downloaded; if automatic downloading of images is turned off, it may look like the user has clicked without opening the email.
Why is my Phish Audit Reporting 'Clicks', but not 'Opens'?
