I could swear that when I first tested my Elgg installation a few weeks ago, "Add New User" sent an email to the new user. Maybe I'm confusing it with the Upload Users plugin which does send an email. I changed the wording of the email slightly in the core language file, lines 963 to 972, but can't see how that could stop it sending the email. Wierd! Am running my site closed, private.
Security issues should be reported to firstname.lastname@example.org!