I ran a simplified test of what you're talking about and it should be very doable. Here's my test:

Step 1, run a record query that gets the change_request recordyou're looking for.
Step 2, run a record query that gets the sys_email record you're looking for.
Step 3, run a server side script that 

a. queries the change_request record from Step 1 and gets all the pertinent fields that will be in the notification and places them into variables in the script.  For example, get the Risk value and store it into a var called "risk"
b. queries the notification_request record from Step 2, but also adding to the query things like...

addQuery('body',CONTAINS','Risk: ' +risk);

You can get really specific with the format here, by looking for an exact match to the body, or you can be a little more generic like I was here by simply asking if the body contains a simple string.  I like this format because it's easier to read and its testing what matters most to me - is the right data there.  If the format gets changed for some reason but the core data is still there, i'm happy to let the test pass at this point.  Perhaps when we get more savvy with ATF we'll find a better way, but this works for now.

I can share more specifics about my test if you'd like, but I'm heading home for the night and will need to do it in the morning when I get back in the office.

Hope that at least gives you something to think about...