It has been reported that notifications in workspaces are misbehaving since a recent TYPO3 security update was applied.
The behavior observed is that email notifications for publish are sent to publishers regardless of what notification preference is set for the workspace, specifically including the preference for no notifications. We have reported the problem to the TYPO3 project and are optimistic that a fix will be included in the next TYPO3 release.
Notifications for "send to review" and "reject" still work as they should.