Hi Beth,
If a user is in a role that has Edit permissions then that user is an approver and can also edit directly and not have workflow enforced on them. If a user is only in a role that has draft edit permission then workflow is enforced on them, so it is important that users who you want to enforce workflow on aren't also in edit roles or it becomes voluntary whether they follow the workflow or edit directly and they can approve their own edits even if they do submit a draft.
So all users in roles that have edit permissions are considered approvers and would receive the notifications. If you want to exclude certain email addresses from ALL notifications you can add this setting to user.config and put comma separated email addresses there.
<add key="EmailAddressesToExcludeFromAdminNotifications" value=""/>
If users in all sites are getting the notifications then I suspect that they are either registered in all the sites and have the same roles in all the sites or you are using related sites mode which means basically the same users and roles are used in all sites. It should not happen otherwise.
It is also possible that we've had bugs reported and fixed in workflow since version 2.3.5.3, that is a pretty old version.
Hope that helps,
Joe