If a user has a high utilization rate for their licenses, then Symantec Endpoint Protection Cloud (SEPC) sends out notifications about running low on licenses
When a user has used 90% of any license type or are within 15 (and then 7) days of service expiry, the emails will be triggered by default and sent to the account administrator email.
To alter these settings, users can navigate to the Subscriptions page within their Settings tab. To the right of the subscription name that is triggering the emails will be a button with a bell and a settings gear. Click this to be brought to the settings page to alter these notifications.