Last friday I were working on setting up permissions for a Sharepoint that'll host a Database (list) for a soon to be widely used app. During the process of making sure no one could access any content they should not be able to, one of my collegues (not member of the private Sharepoint) created a News Post. The most weird thing is that other people who's not members of the Sharepoint got an email notification that this news post were posted.
Is that by design or what could have caused it? The permissions are very restrictive so people who are not members basically see a blank page but are able to make edits in a list through a PowerApp.
So if a news post has been created on a site, the users who have access to that site will get a notification that this might be a news that you might have missed or the user can also send it out in outlook as a newsletter and select who get's it.
Also sounds abit like you're mixing up site and list permissions (?)
Double check the permission of the site and also if it's the same site that the news was created from