It's specifically a password reset email. A Google Workspace admin can send a password reset to any of their users, and it will pass DKIM and SPF. The trick here is that apparently you can sign up for Workspace with a g.co subdomain and, without verifying the domain, can trigger a password reset to be sent.
I’m still a bit confused around how they sent him the email. Maybe they added him to the Google Workspace as a member?
Yeah they did. They added his email as a secondary email to a Google Workspace user account, with the plus-address-suffix including a "Case ID". Then they reset the password of the user account, triggering this notification.