For the link, you could concat the users id from there account on your system and timestamp and then run it through a hash, such as md5 to create the unique link for them to send out. Then, have a page that accepts these dynamic hashes and when someone goes to the page, store the ip address and set up a logging table that you can do a count against.
That would be the basics where I would start.