It sounds like this is the kind of email you might get if you . . .

. . . logged into your wallet from one browser (say, Firefox) and then later from another (say, Opera) . . .

. . . or . . .

. . . logged in from one IP (say, at home) and then later from another (say, in a coffee shop).

Or maybe it takes a combination of differing browser/IP to trigger that mail.  Not sure how blockchain.info does things.

Is that a possibility?