Should WF be sending alerts ONLY to email address set in options?

I think normally, only the addresses in the “Where to email alerts” option should receive the messages. Was the client’s email address previously included in the field, but later removed?

If so, you could try the option “Disable config caching” near the bottom of the Wordfence Options page. (On certain hosts, this helps fix options that aren’t saving correctly.)

Just in case — if you have a development/test server for this site, you might want to double check the email settings there.