I've heard the "a page you created in the last 30 days was linked to" idea from a couple of people so let me put in my vote against.
I really dislike complicated, mysterious behaviour. If the logic can't cleanly be described in the text description of the notification, then I think it's the wrong logic. I don't think any notification type wants a day limit filter, or a for users with <x edits filter, or any other logic that will be confusing to recipients.
The cure for spam is to not auto enable email notifications for existing accounts, and to put work into email cadence controls across all notification types (except talk page messages) before launching to "real" users. Applying weird custom business logic to different notification types is a recipe for bugs and confusion and will just lead to more weird single case cures when you hit power users who still hit their personal spam threshold on 30 day limited pages.