Project privacy set to public. By default, its content is available to everyone (authenticated or not). Please note that more restrictive permissions might exist on some items.
When a text field is updated (in text format), then there is a bunch of HTML tags that are sent in the text/plain version of the email notification: