It doesn't necessarily mean the info came from the reports though. Maybe he has/had an existing relationship with Citi via a CC or store card. Maybe someone else sold his name and info to Citi. The latter certainly happened to DW and I while opted out. She kept getting offers from Amex and Discover, though the name used was a variant nowhere to be seen on her CRs.

"If you want to opt out from these offers" isn't indicative of a preapproval, though. In the past DW and I always got letters from creditors (opted in or out) and had that statement within the T&C somewhere. Most all of the time we were never approved when we app'd (throwback to our bad credit days). That statement means that "if you want to stop receiving our junk mail, you can opt out from us too". (paraphrased).

If all else fails have him check his CRs again to make sure it says "opt-out".