It seems pretty simple. PVPN keeps logs of when end users connect. Google keeps logs of which IPs access accounts. Google discloses that the victims account

It seems pretty simple. PVPN keeps logs of when end users connect. Google keeps logs of which IPs access accounts. Google discloses that the victims account was accessed by a set of IPs. Those IPs are known to belong to PureVPN. A list of people connecting to those IPs as clients is requested by the FBI. The connection logs validate their suspicions.