In our forums, I've noticed that if I enable the replace words feature, the words are very easily replaced in the titles and bodies of forum posts. However, the email notifications still have the terms in them. So the emails are definitely sent prior to the words being replaced, or the words are only replaced during rendering. Either way, the emails should not have the original words in it. As an example, a site could very easily begin distributing spam or profanity via e-mail if someone were so inclined.