Defender Seems to Pick Admin Randomly

I installed Defender on one of my websites. There are three administrator accounts.
WordPress User ID 4 is John.
WordPress User ID 5 is Shane.
WordPress User ID 9 is Mel.

My email address in the Settings screen but is not associated to a user account, as I have been logging in with Shane's account details.

The Dashboard screen uses Shane's name as the name for greeting "Congratulations Shane! ... Get Fixing Shane!...."

On the Hardener screen ... "You have a few security risks, Shane!"

IP Lockouts > Report automatically set up to send to Shane.

But notifications automatically picked John. So when I ran the scan and the GENERAL SETTINGS email address picked John's address. (As he is the first admin account the system meets in the database?)

How does Defender pick who to send the information to? I assumed it would go to the General Settings email address (mine) but if it has to go to an administrator, how does it pick which administrator is the highest priority??