SPF result using alias email address
I have received a threatening message in my email primary@gmail.com from my other email address alias@mydomain.com. Note that alias@mydomain.com is an alias to primary@gmail.com. Also, of course, I own mydomain.com and it is registered in Google Domains. Message says my address alias@mydomain.com has been hacked and I want to find out if it's true.
Email went to spam. After inspecting email headers, I see SPF result is "neutral". I see here that it is possible to configure Gmail to send emails using alias addresses. I have never configured it, though.
First question Since primary address is managed by Google/Gmail and mydomain.com is registered also in Google (Domains), shouldn't SPF result be "pass"?
Second question Attacker says "I managed to log in to your email account alias@mydomain.com". Does it make sense? Is it even possible to login using an alias? Should I just assume it is a scam and ignore right now the message?
