currently, notification messages are stored in a folder "inboxes" under $PUB_HOME/config/access-control. this should be fixed. maybe some fine day we will have everything that needs to be persistent in our repository... until then, i suggest content/inboxes.
The problem with using repository items (i.e. documents) for inbox messages is to assemble the inbox of a user. Queryable meta data would come to the rescue. Actually Lucune should be indexing the meta data, maybe it's just a matter of doing the right query?