1. Where is it configured please? I initially thought it would be CB Anti-spam but there are no settings there.
That can be configured within CB AntiSpam > Parameters > Login > Log.
2. When I override the standard text using the key: WE_NOTICED_A_NEW_SIGNIN_WITH_YOUR_ACCOUNT_USERNAME_8c944f within CB language overrides, it sends the email using my HTML as I want but, signing into the backend results in the original text being sent rather than my new version with HTML. It's almost as though there are two language overrides for CB, one for the frontend and another for the backend.
CB AntiSpam doesn't work with backend logins. So my guess is Joomla itself is sending the backend one.