Hi at all.
It seems incredible that a user with only “Edit” rights can add/remove a user from a project or change all the notification setting he wants.
Please check it.
I think this kind of changes may be available only to owners or to admin (you may add it as rule).
Thanks