AFAIK, it's not illegal (per GDPR) to process EU citizen data in data controllers if the individual is no longer in the EU.
_Edit_: Yes, I read the article. It looks like this person got this email notification because they had activity in London (per their resume on their website). That doesn't make the email illegal nor does it mean their activity in Italy is going to be on a non-EU controller.
The email implicitly states that it's for the UK only.