No need to check project because:

sent_notification.project would never be nil, and
we also have already checked message_project before
entering process_create_issue.

lib/gitlab/email/receiver.rb

@@ -79,8 +79,7 @@ module Gitlab
         raise UserNotFoundError unless author
         raise UserBlockedError if author.blocked?
         # TODO: Give project not found error if author cannot read project
-        raise UserNotAuthorizedError if project.nil? ||
-                                        !author.can?(permission, project)
+        raise UserNotAuthorizedError unless author.can?(permission, project)
       end
 
       # Find the first matched user in database from email From: section