Is there a need to expire email verification code?

I've registered a GitHub account to test their email verification process. So:

1. They've sent me an email with a link, containing my username and 40-chars code, like: https://github.com/users/USERNAME/emails/120066679/confirm_verification/47889d71648523e5d99db5b969f59809c2715fb6

2. I have not followed the link

3. 4 days later, the've sent me another (a reminder), that I have to verify my email, containing link with another different 40-chars code

So, what was the purpose of changing 40-chars code? As I remember, other services, used to expire verification code anyway. If there is already a username in verification link, is there really a need to do that? In case of brute force, they can just count failed attempts related to specific user and block it, right?

P.S. Also interesting, what is the purpose of emails/120066679 in link? (which is similar for both letters)

There are several reasons why quick expiration of verification codes is the best practice.

If protection with a verification code is deemed appropriate, it's safest to make it not only complex enough but also valid for minimum amount of time. If you only make the code work for the time needed (usually really short), you diminish the risk of someone abusing it. (For example, someone could programmatically 'guess' the codes - the more time for this exercise, the higher chance for success.)

Also, it's not efficient to store data of this kind. It's used once, it doesn't contain any actual information and as soon as it's used, it's ready to be "thrown away". It's not a good practice to store anything that doesn't add value when stored.

In addition, it's fairly rare that users don't use the codes immediately/soon. For the small percentage of cases where the code expires by the time the user tries to use it, it's more efficient to generate new ones.