What I would expect and hope for is that at step 4 the test user would only get the email from THREE@three.com. They would not get an email from discourse at all, though the notification can and should still appear on the notification menu when next they log in.
This issue is not a major one for staff, but it can and will get confusing and annoying for members who will get an extra email and not know where to go to reply.
Do you mean “suppress the discourse notification” in bold above, because I am really quite unclear how we would “suppress” the fact that you just mailed someone from your mail client. Do you expect us to to contact google, who sent the mail, and remove that email you just sent, somehow?
FYI, I think the behavior I am expecting is used in the discobot functionality. The tutorial PMs are not delivered by email but do appear on the notification menu to be discovered next time the user logs in.
Up until now if ONE replied to TWO and THREE, it would have been rejected by Discourse because the reply key didn’t belong to ONE. It belongs to THREE. But since Discourse knows that ONE was CC’d in step 3, it will now allow the incoming email from ONE.