Just now, 2 months later, the same issue happened with a security login email from Stripe.
Because companies send a LOT of spam emails / promotions etc that they have to come up with alternate domains to send emails. On customer side its very difficult to know the truth.
And I don't see why you'd need to be less tech savvy to use "mark as spam" on automated e-mails sent to you that you didn't ask for and don't want to receive.
The likes of Google and Microsoft have applied embrace-extend-extinguish to possibly the most important communications medium of modern terms, successfully making it less reliable than it has ever been for sending legitimate, actually important stuff. They really should be strongly and publicly criticised for that. False positives in spam detection are, for the most part, more damaging than false negatives.
It just happened for the same user, but it seems to be a long standing issue. In the old thread another user was complaining about Stripe emails getting the same treatment: https://news.ycombinator.com/item?id=19100629
The "via" next to the sender address in your screenshots (https://support.google.com/mail/answer/1311182?hl=en) suggests that there might be a DMARC problem (on their side or yours) that could be causing this filtering.
https://news.ycombinator.com/item?id=19100332
As mentioned there, the "via" most likely comes from the fact that the recipient address is a Google Groups address that multiple people can receive.
Also, as mentioned in the Github issue, Google's G Suite security staff has checked the headers (in the Paypal case) and come to the conclusion that nothing is wrong with them, and that it's a Gmail issue (and that the fact that the recipient is a Groups address should make no difference for spam filtering).
https://github.com/nh2/gmail-spamfilters-paypal-security-mes...