TL;DR: Go to
about:debugging#workers in Firefox or
chrome://serviceworker-internals/ in Chrome, find the relevant entry, and click "unregister".
It seems this is caused by 'service workers'. In Firefox, you can see them in
about:debugging#workers (put that in your address bar). I discovered dozens of service workers, all supposedly stopped (none of them were marked as running), but Telegram was amongst them and I was definitely still getting notifications from the tab which I closed long ago.
After clicking "unregister", the worker disappeared and I no longer get notifications.
The notifications are pushed to the worker via some service, such as Mozilla's own push service. Each message has a time-to-live. If this time is long enough, the message will even be delivered the next time you start your browser (in case you closed the browser or were offline).
This is the first time I hear of anything in a browser, other than extensions of course, that remains actively running after closing a tab. Seems like this is even better than cookies if you want to track someone... every time they come online they'll announce themselves to you again.