We noticed a login to your Acme account from a new l... | NginxProxyManager/nginx-proxy-manager

I just received an odd e-mail from my server claiming that "We noticed a login to your Acme account from a new location."
I've never received such a notification before and I'm not quite sure what this could mean.
My best guess is that this was caused by NGINX Proxy Manager.
Despite it being in a docker container, the support at OMV claimed it's possible NPM used postfix to notify me throu an e-mail.
Here's the header of the e-mail

Received-SPF: pass (google.com: domain of MYEMAIL@gmail.com designates 209.85.220.41 as permitted sender) client-ip=209.85.220.41;
Content-Type: text/html; charset=UTF-8
From: "Support" <MYEMAIL@gmail.com>
Subject: [brie] Login from a new location
To: MYEMAIL@gmail.com
Message-Id: <20250325003302.AC74960EEA@brie.localdomain>
Date: Mon, 24 Mar 2025 21:33:02 -0300 (-03)


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
    <meta name="viewport" content="width=device-width,initial-scale=1" />
    <style>
        body, html {
            padding: 0;
            margin: 0;
            border: 0;
            color: #16161a;
            background: #fff;
            font-size: 14px;
            line-height: 20px;
            font-weight: normal;
            font-family: Source Sans Pro, sans-serif, emoji;
        }
        body {
            padding: 20px 30px;
        }
        strong {
            font-weight: bold;
        }
        em, i {
            font-style: italic;
        }
        p {
            display: block;
            margin: 10px 0;
            font-family: inherit;
        }
        small {
            font-size: 12px;
            line-height: 16px;
        }
        hr {
            display: block;
            height: 1px;
            border: 0;
            width: 100%;
            background: #e1e6ea;
            margin: 10px 0;
        }
        a {
            color: inherit;
        }
        .hidden {
            display: none !important;
        }
        .btn {
            display: inline-block;
            vertical-align: top;
            border: 0;
            cursor: pointer;
            color: #fff !important;
            background: #16161a !important;
            text-decoration: none !important;
            line-height: 40px;
            width: auto;
            min-width: 150px;
            text-align: center;
            padding: 0 20px;
            margin: 5px 0;
            font-family: Source Sans Pro, sans-serif, emoji;;
            font-size: 14px;
            font-weight: bold;
            border-radius: 6px;
            box-sizing: border-box;
        }
    </style>
</head>
<body>
    <p>Hello,</p>
<p>We noticed a login to your Acme account from a new location.</p>
<p>If this was you, you may disregard this email.</p>
<p><strong>If this wasn't you, you should immediately change your Acme account password to revoke access from all other locations.</strong></p>
<p>
  Thanks,<br/>
  Acme team
</p>
</body>
</html>

And the e-mail itself:

Here's what I assume happened:

NPM generates a certificate through my domain provider's API (porkbun in this case) and on porkbun's UI there's another place where you can generate certificates;
My NPM uses one of them and the other was created automatically when I registered a redirect record (URL forwarding) in the afternoon;
Seeing that both the API and the manual way are generating certificates on my porkbun account, it's using the same email and NGINX consideres that "logins from different locations"
The second one seems to have taken quite a while to propagate so that's why me getting this message in the middle of the night worried me;

Anyways, if that's really what it is, I still find it surprising that searching for the exact string "We noticed a login to your Acme account from a new location." gives me nothing. Feels like I'm the only person that's ever gotten this e-mail.
If possible, I want to know if it this is part of NPM's behaviour and if my assumptions are correct, and, if not, what should I be doing to remedy it.
Thanks

We noticed a login to your Acme account from a new location.

Description

Contributor guide

First steps

Research direction

Assessment