Hello,
You should look in SOST for when the email was sent and who sent it. If it was sent by WF-BATCH then it comes from workflow. Using the date and time, go to SWI1 and figure out which workflow sent the email. The workflow log should then give you a clue for where to look (e.g. in which methods).
regards
Rick Bakker