I got hit by this exact one(free iphone X) recently, and couldn't find anything in my email.

Surely, that kind of email would just look like spam, so isn't the correct solution for google to just not auto-add calendar events if their source email is spam?

Yep, my wife got exactly the same thing. Apparently those entries will appear in your calendar even if the email was sent to spam. You have to configure gmail to not automatically add the entries.

This seems like a pretty big oversight on Gmail's part.

No, it wasn't that - I had the auto invite setting turned off already, and I didn't have any emails that matched the calendar entries.

I was fairly sure it must be malware, but I had no idea how to find out which app it was. I tried Avast AntiVirus, but it found nothing. After finding out about CamScanner I tried Kapersky AV, which did flag CamScanner as malware.