It was legit from Google email and servers.
You cannot spoof an email from @google that will inbox
They clearly did.
You can trigger emails from Google on behalf of other users or use a platform like Google Cloud or Google Sites to trigger emails that come from real Google servers.
This was not spoofed.