Yup, as mentioned, it was verifiably paypal.com in the very headers. It's the lack of the spoofing that caught me off-guard.
But, further below in the thread it appears that any business on PayPal can just send fake invoices powered by the official service@paypal.com domain, so...yeah, that's wild.