Hi !
It could have been, but no.
The NFW notification gives several information:
– the type of action -> update
– the target version -> 5.2.4 (currently in 4.9.12)
– the identifier of the user who operated
– the IP address of the user
– the date and time
– the url of the site concerned
I can assure you that we checked before we contacted you.
The site is still in 4.9.12 and the user who hid the update knows WordPress very well and was not mistaken.
Have a nice day !