The participants list is calculated based on hits from the Tracker module to the event module. Note that this may include users who had access to the event at one point, but no longer have access. In this case, the mail is sent to those users, but the users will not be able to access the event.