> except its not a spoofed email. It's really from Google

Read the text shown in the screenshot in an article. I am 99.9% sure that is not from Google. The wording screams scam to me, most likely from someone who is not a native English speaker.

Among many many other red flags, it specifically says not to try and change your password for 6-12 hours and to not share the details of the email with anyone.