If you have a wordpress or a joomla it could come from here.
Your yunohost is up to date ?
And your app ?
You can watch your mail log in case it’s postfix that send this mail
tail -f /var/log/mail.log
If you see mail don’t send by you, you can stop temporarily postfix
service postfix stop
If you don’t see any strange email :