security notifications (new device, password changes, 2FA) always go to your email and can't be muted.