Can the user be logged/signed up or are those anonymous prospects with no user account?

If they are anonymous you can simply say that 1 given user can only create 1 notification.