A few hours ago I received the failed emailed content twice. I checked the device and found unknown Iphone has access to my account. I revoked it. Then, I checked the access log and found several web access from unknown IP from date 26/3 and 8/4, 2017.
So, I decided to deactivate my account. But, after reading this thread, I decided to reactivate my account and post my experience to let anyone knows.
Hope my data is safe but who knows, even evernote cannot do anything about it as we never receive any notification of this issue or any suspicious activity.
Please add the notification feature asap so we can prevent any unwanted things happen to our account.