@powas
I read up on the topic of WordPress security
and I did the following to stop getting all those annoying emails
I disabled wordpress xmlrpc because that is how these people are doing bulk brute force attacks, then I installed a google nocaptcha plugin to stop any bots from using the login page, and also deter any bored person.
then I also switched to daily digest email. but I still occasionally get backup notifications from ithemes security even though I disabled that.
Plus I did some other tweaks which I don’t remember offhand..
Hope this helps