What data sources does Facebook use to trigger the email?

And are emails manually approved before they go out? If so, does that mean a Facebook employee looks at the data source that triggered email, which in some cases may be the user's private messages?