Occam's razor attempt at explaining this. You are connected on LinkedIn, your client got your gmail from your LinkedIn profile, and now the gmail address is set in the "primary" field of their contact card for you.

My 2 cents, without having any more context than what you described.

There are more elaborate/automated versions of what I described in B2B marketing (like auto update of CRMs based on LinkedIn data). Pretty standard stuff.

I tend to stay connected with business acquaintances when they are in between jobs, and in those periods, i keep their publicly given Gmail on file to engage with them. I try to update with new pro addresses when they find a new gig, but the update is not always systematic.

Fair. My client is not a business tho, this is a B2C relationship. So it’s seems unlikely, tho not impossible that they would be using such tools.

The Gmail address in question is not linked to my LinkedIn profile.

Is it possible your client got hold of your personal address indirectly somehow - via a mailing list or something? Maybe in the course of replying, they removed your Outlook address by mistake and then in retyping it, GMail suggested your personal address? Clutching at straws I know...

It seems incredibly unlikely they would have found my personal email address somewhere else (this is non-dev, non-business, non-technical relationship. It’s B2C)

The Gmail angle seems the most likely, but I’m unsure how, or why.

Agreed, this is the most plausible.

Is your gmail setup with your same outlook client?

Is your gmail available "on the web"?

Did you set a reply-to:?

This seems to be the only plausible explaination apart from the client actually looking up your email address completely separately, which doesn't make sense at all if it was a reply to your original email.

No reply-to: set.

Gmail is only used via browser. On my laptop.

Outlook is setup on my iPad.

Gmail account is NOT setup in Outlook.

Was your original message sent with Reply-To header?

Does the reply have In-Reply-To header matching Message-ID of your original message? If you're unable to see Message-ID of messages sent, does the domain part in In-Reply-To header match your work or private address?

There is no in reply to header.

The original email is not in the chain.

It’s like they created a new email, to me personal email.

Note: there were some attachments on the email.

The client has filled out the forms (docx + 2x PDF), and the filled versions are on the return email.

Just look at the email headers to see which email it was sent from or if there was a reply-to.

Where is your personal gmail available on the internet? Maybe it's on your resume and the person checked out your resume before responding to you?

Most likely is they know you and have your email. I would just ask them.