I noticed Kristen posted a similar solution while I was typing this.  I'm posting it anyways, the difference is that mine involves adding a new notification rather than changing the existing "Incident worknoted for ITIL" notification.

This probably isn't an elegant solution, but I'm thinking you could copy the email notification and make some changes.  This new copied email notification would be modified as such: 
Send when: event is fired.  We would need a new event, called say incident.worknoted.  
Who will receive: Users/Groups in fields -> Caller

Create the incident.worknoted event.

And finally create a new business rule, same condition as the email notification: incident table, work notes changed. It would be advanced and have a script similar to below:

var user = gs.getUserByID(current.getValue('caller'));
var hasItil = user.hasRole('itil');

if(user.hasRole('itil'))
{
	gs.eventQueue('incident.worknoted', current);
}