Email alerts are sent only for critical security events:
- Admin authentication threshold exceeded (5 failed attempts)
- User authentication threshold exceeded (10 failed attempts)
- Automatic IP blocking is triggered
- Critical security events requiring immediate attention