I suspect this is linked to a google plus profile, perhaps the email is used/verified on a google plus public page or profile, or just the email of someone with an account on Google Plus.
I checked the original text of a message that I've seen this, and there was no X-Face header, or any other headers with images. However, hovering over the From line, in the extra details popup, shows another popup with a name linked to a Google plus profile (the email is not public on this profile), and offers actions to add to circles, hangout, etc.
This would explain why someone without a Google Apps account could have one, it could be a google -sans gmail, account,or google apps,or perhaps even a gmail, with a secondary email?