You are correct.
A signature-based system might not detect that event as malicious since it is a legitimate use of the email system. It would not alert at all.
An anomaly-based system might see the unusual connection and alert.
However, whether or not this is "false" requires a bit of philosophy. It is an anomaly. It's just not malicious since the scenario says that we know that the legitimate user accessed the system. So it might not be an alert we want to or need to see.
In many contexts, if someone accessed the email system outside of the normal window, security teams would want to be alerted in order to confirm that the access was malicious or not.
So, the question of whether or not this is "false" is not the right question to ask. It's a true anomaly. It's just not malicious activity only because we know that the legitimate user enagaged in the authorised activity.