“I happened to look at the original and it says SPF, DKIM and DMARC all passed.”
The scam mail carried a valid paypal.com DKIM signature. The key belonged to an old Silverpop marketing setup that PayPal never retired. The email had no phishing link, just a phone number to call about unclaimed funds. Every forgotten vendor key is a signed permission slip for whoever finds it.