Besides these, check the "In use by" section for the device page (your mobile app device, usually named something similar to your phone), which you can get to from the "Devices" page in the Hubitat admin UI. There could be another app (including a rule) beyond the ones you know about, and this would say for sure.
But otherwise, my guess is similar to the above: if your admin UI isn't restricted, someone could just be going in, typing "Hi" into the "Device Notify" command box, and sending it from there.