I'm running ES 6.4 with X-Pack installed. There are builtin alerts for cluster awareness:
I'm receiving email alerts for cluster severity, shards allocation etc which are coming in from "X-pack Admin" with one of my email addresses. These watchers are most probably the origin. Where are these Watchers taking the destination and From email addresses from?