Hopefully you can turn this off. I've seen cases where attackers enter an email address and just keep spamming the login form until the owner accepts the notification. Obviously 2fa would help here but not everyone uses that.