I installed LoginNotify locally to investigate T329774. I tried to trigger it, but there was no notification. An event was inserted, but not a notification.
So I logged into production and did
SELECT MAX(notification_timestamp) FROM echo_event,echo_notification WHERE notification_event=event_id AND event_type='login-fail-known';
And found that the most recent LoginNotify notification was sent on 2023-01-05. This date corresponds to bc6e531aa2d410f42c65fe01d4b9767ce40b8c96 in which the locator was changed from locateEventAgent to locateArticleCreator.
LoginNotify events do not have an associated title, so locateArticleCreator() returns an empty array. They use (misuse?) the agent as the recipient.