Happening with iThemes Security Pro version 5.4.8 as well. For us it’s the File Change Warning that ignores the notification settings and sends it to all users instead of just the admin. It doesn’t happen on all of our sites though, and they all use the same configuration.