User not in the sharing project access list receives email notifications.
Occasionally Project Managers or Admins will inadvertently assign incorrect users work on a project. Even after removing the user from the sharing access list, emails are still going out to these end users. This is very frustrating especially in very active projects or request queues. The sharing or project access list has nothing to do with who receives email through the Workfront system event handlers. Email notifications only get processed if the user is a member of the project team.
Clearing a user from the project team
Once a user is assigned work on a project, they are automatically added to the project team. All users in the project team receive emails if the system event handlers are active. Emails are not governed by access/permissions, they are governed by whether users are on the project team. Check to see if the user is in the Staffing field for the project. This is found under: Project -> More ->Staffing -> Removing users from the staffing list should clear the user from the project team and stop any future email notifications from being sent.