The OrderBox system sends out SiteLock threat notification emails to your Customers, if the Product Mails have been enabled for them. However, the Customers will not be notified of the threats if these mails are disabled for them. You need to handle the threat notifications as explained below in such cases:
Fetch a list of pending threat notifications from the OrderBox system.
Run a cron to send out mail alerts to your Customers, based on the data received from step 1.
Use the Notification ID(s) received from step 1 to inform the OrderBox system that Customers have been notified about the specified threats.