What message triggers can be found in the dedupe process?
Is it this wordpress feature?
https://wordpress.stackexchange.com/questions/202783/fwd-website-name-notice-of-email-change

https://build.trac.wordpress.org/browser/tags/5.3/wp-includes/user.php#L2056

Short answer to prevent it: add_filter( 'send_email_change_email', '__return_false' );

Any time a contact record is updated, civi will attempt to update the corresponding user account in the CMS for name and email. So it would only be for contacts that have an associated user account.

You can also turn this sync off at Administer - System Settings - CMS Database Integration - Sync CMS Email, but then your users and contact records can get out of sync.