The Extension Manager will make the call back for any registered events. This is true even with nested calls. In the case of updating a document there is a code path that creates a temporary document which is what is triggering the EM_NSFNOTECREATE event you're seeing in this case.
On deleted documents, once again depending on code paths and setup, a delete call may actually be going through the NSFNOTEUPDATEXTENDED callback with a flag set for UPDATE_DELETED. If you look at the C API reference you will not that it states: "NSFNoteDelete specifies this flag when it calls NSFNoteUpdate in the process of writing the deletion stub to the disk."
I'm still looking into the number of EM_NSFNOTEUPDATEXTENDED notifications as updated docs and will post an update when I have more information.