please avoid constructing queries this way. Use the safer parameter method whenever possible.

for now, let's also include groups

or perhaps simply exclude hosts

It seems strange to me to have users.id = build_notifications.user_id as a clause rather than a join condition. I guess they are technically equivalent here, but it seems like it would be clearer to have an explicit join as we do elsewhere.

We don't want a left join here

This changes the return type of this function.
While tag_notification simply loops over the result, build_notification passes it verbatim as an option to the buildNotification task. This will break because set objects cannot be represented in xmlrpc.
Probably just return list(set(emails))

Commit 882f5131 fixes this pull-request