[Bug]: Shared-folder upload emails are sent even when all notification settings are disabled

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Only some Users experience this. They get sent a e-mail when someone uploads a file or creates a folder into a public folder.
Their notification settings are all off.
The activity settings look like this:

Steps to reproduce

1. create a public folder
2. upload a file or create a folder
3. recieve e-mail

not all users have this issue only some, it seems to be random

Expected behavior

The users don't get any e-mails when a file is uploaded or a folder gets created

Nextcloud Server version

30

Operating system

Other

PHP engine version

PHP 8.2

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Updated from a MINOR version (ex. 32.0.1 to 32.0.2)

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "nextcloud.company.net",
            "box.company.de",
            "box.company.com",
            "testbox.company.com",
            "database.company.de"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "overwrite.cli.url": "https:\/\/nextcloud.company.net",
        "version": "30.0.6.2",
        "installed": true,
        "overwriteprotocol": "https",
        "ldapIgnoreNamingRules": false,
        "ldapProviderFactory": "\\OCA\\User_LDAP\\LDAPProviderFactory",
        "skeletondirectory": "\/var\/www\/nextcloud.company.net\/htdocs\/data\/_skeleton\/",
        "log_rotate_size": 10485760,
        "maintenance": false,
        "loglevel": 0,
        "mysql.utf8mb4": true,
        "enable_avatars": true,
        "trashbin_retention_obligation": "auto, 30",
        "htaccess.RewriteBase": "\/",
        "default_phone_region": "DE",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 6379,
            "dbindex": 1
        },
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "dbtype": "mysql",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_smtpauthtype": "LOGIN",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "preview_max_x": 1024,
        "preview_max_y": 1024,
        "preview_max_scale_factor": 1,
        "enabledPreviewProviders": [
            "OC\\Preview\\PNG",
            "OC\\Preview\\JPEG",
            "OC\\Preview\\GIF",
            "OC\\Preview\\HEIC",
            "OC\\Preview\\BMP",
            "OC\\Preview\\XBitmap",
            "OC\\Preview\\TXT",
            "OC\\Preview\\MarkDown"
        ],
        "proxy": "proxy.company.de:3128",
        "app_install_overwrite": [
            "groupfolders",
            "user_saml"
        ],
        "activity_use_cached_mountpoints": true,
        "auth.bruteforce.protection.enabled": true,
        "maintenance_window_start": 22
    }
}

List of activated Apps

Enabled:
  - activity: 3.0.0
  - admin_audit: 1.20.0
  - app_api: 4.0.6
  - bruteforcesettings: 3.0.0
  - cloud_federation_api: 1.13.0
  - comments: 1.20.1
  - contactsinteraction: 1.11.0
  - dav: 1.31.1
  - federatedfilesharing: 1.20.0
  - federation: 1.20.0
  - files: 2.2.0
  - files_antivirus: 5.6.1
  - files_pdfviewer: 3.0.0
  - files_sharing: 1.22.0
  - files_trashbin: 1.20.1
  - files_versions: 1.23.0
  - firstrunwizard: 3.0.0
  - groupfolders: 18.1.1
  - impersonate: 1.17.1
  - logreader: 3.0.0
  - lookup_server_connector: 1.18.0
  - nextcloud_announcements: 2.0.0
  - notifications: 3.0.0
  - notify_push: 1.0.0
  - oauth2: 1.18.1
  - password_policy: 2.0.0
  - photos: 3.0.2
  - previewgenerator: 5.8.0
  - privacy: 2.0.0
  - provisioning_api: 1.20.0
  - recommendations: 3.0.0
  - related_resources: 1.5.0
  - serverinfo: 2.0.0
  - settings: 1.13.0
  - sharebymail: 1.20.0
  - support: 2.0.0
  - suspicious_login: 8.0.0
  - systemtags: 1.20.0
  - text: 4.1.0
  - theming: 2.6.0
  - twofactor_backupcodes: 1.19.0
  - updatenotification: 1.20.0
  - user_ldap: 1.21.0
  - user_saml: 6.5.0
  - user_status: 1.10.0
  - viewer: 3.0.0
  - weather_status: 1.10.0
  - webhook_listeners: 1.1.0-dev
  - workflowengine: 2.12.0
Disabled:
  - circles: 30.0.0 (installed 26.0.0)
  - dashboard: 7.10.0 (installed 7.0.0)
  - encryption: 2.18.0
  - files_downloadlimit: 3.0.0 (installed 3.0.0)
  - files_external: 1.22.0
  - files_reminders: 1.3.0 (installed 1.3.0)
  - survey_client: 2.0.0 (installed 1.8.0)
  - twofactor_nextcloud_notification: 4.0.0
  - twofactor_totp: 12.0.0-dev

Nextcloud Signing status

Technical information
=====================
The following list covers which files have failed the integrity check. Please read
the previous linked documentation to learn more about the errors and how to fix
them.

Results
=======
- core
	- INVALID_HASH
		- lib/private/Notification/Manager.php
- bruteforcesettings
	- EXTRA_FILE
		- .php-cs-fixer.dist.php
		- l10n/.gitkeep

Raw output
==========
Array
(
    [core] => Array
        (
            [INVALID_HASH] => Array
                (
                    [lib/private/Notification/Manager.php] => Array
                        (
                            [expected] => 0b4b9ac99d2b40da071b6fe0e3675aaf3a747b6b1f8e9a61440bd6744def28798a190b0a0beb6de6fb979ae050eecfea181d33c252992674ff57110def1fa14e
                            [current] => 3daba3b46c6d450c5558085b5f366b98ae019db255b126f824ae04bd48586b5d5997b72f718873aa397d2277635bc9a1bce27ecfae8f2db3dcc4d0aa95e8611f
                        )

                )

        )

    [bruteforcesettings] => Array
        (
            [EXTRA_FILE] => Array
                (
                    [.php-cs-fixer.dist.php] => Array
                        (
                            [expected] => 
                            [current] => a768a02ed4d9c9dfc8686d94cb3d921c851afb5598d9dd0b3b2abf9097e25a0276fc5eb53b1ec4fd1ff79583b24ed5fc09ad379e17068fd74bf2a2522c388248
                        )

                    [l10n/.gitkeep] => Array
                        (
                            [expected] => 
                            [current] => cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
                        )

                )

        )

)

Nextcloud Logs

Additional info

No response

Start by reviewing lib/private/Notification/Manager.php, which the report identifies as failing the integrity check, and trace the notification path for shared-folder uploads and folder creation. Reproduce those steps with all notification settings disabled; no test or useful log output is provided, so compare the observed email behavior with the expected result. Done means affected users receive no email when every notification setting is disabled.