@voltronik Thanks for your response. After further testing, I’ve found that even after disabling BNFW, WordPress will still send out the new user email even when just updating a user via the API. So I believe it’s either an issue with WP Core or an issue with some other plugin. I’ll test again on a vanilla WP install.
Doesn’t seem to be an issue with BNFW, but for your reference I am sending a curl request to these endpoints on my site
Create User (sends new user email): POST /wp/v2/users/
Update User (incorrectly sends new user email): POST /wp/v2/users/<id>