I agree: it won’t have been Google (and the email came to a non-Google email address), but some data aggregator somewhere who is cross referencing login emails

I agree: it won’t have been Google (and the email came to a non-Google email address), but some data aggregator somewhere who is cross referencing login emails with stored cookies.