Hardcoded logic based on the following:

Logic is not evaluated at the time the integration/feature enablement. We don't want to hammer your inbox with notifications for nothing
Daily comparisons evaluated(previous days record at scan time vs new record at scan time)
For a given user, alert is sent if a previous days record was compliant (Legacy Authentications were disabled) and the new record is non-compliant (Legacy Authentications are enabled).
When a new user is added to the environment without Legacy Authentication being blocked, a notification will not be generated, as that is their baseline state. This avoids unnecessary notifications for things like Service Accounts.

What are Blocked Legacy Authentication Alerts