they forgot to include a message-id

something the RFC standard recommend but doesn't require

but it being required is a de-facto industry standard for sending automated mails

and is clearly documented by support sides of large mail providers (like Google)

the mail standards only defines what parts you can put together, but widely fail to define how this parts can be interpreted, what are sensible combinations, etc.

and they don't cover spam/suspicious mail detection at all

so you can't just go by RFC, you need to read up on what all larger mail providers have as additional requirements (which mostly are the same, and Message-Id being the most common dominator) and then hope that another provider you didn't read up one doesn't have some other surprising rule (which doesn't tent to be the case if you don't do anything surprising, but it sucks anyway).