Sites on previous minor versions (the middle dot in the version number) will generally automatically upgrade to new patch versions (the last dot) if there’s a security release.
For example, a site on 4.4.3 might automatically upgrade to 4.4.4 if a security patch release was issued for 4.5.2 to 4.5.3. This means that security patches can be automatically applied, while keeping entire minor version upgrades as something you initiate yourself.
This only explains though why a site may have automatically upgraded to what is still effectively a previous release – it doesn’t explain what has happened in your instance.
It’s very unlikely WordPress will be actually sending out emails saying it has upgraded to an old version number when you’re on the latest version. It could be down to a number of esoteric things, such as an old upgrade email getting stuck somewhere in your mail server’s spool.
If you’re worried that you have been hacked, I’d do a diff against the latest version of WordPress to ensure everything is intact. Still, a hack is very unlikely to send out fake upgrade e-mails…
EDIT: I can’t find it mentioned on the WordPress site apart from in the archive, but 4.4.4 was likely the security release that corresponded with 4.5.3, given that there’s now been two security releases for 4.5.x, and 4.4.2 was the last official version released in the 4.4.x series.