I'd reach out in Slack DM (or whatever method of daily communication is commonly used) and ask: "Hey, was just reviewing on your PR (it's looking great) and noticed some familiar code from [name of source]. Do you know if we need to include attribution for these parts to be safe? [Link]"
It opens the conversation with a "casual" question - asking for advice, even - rather than a straight up accusation. The "it's looking great part" is likely unnecessary, I just have a habit of trying to throw in something good to start on a more positive note. It does ignore whatever claims have been made about writing the code that was taken, but perhaps it's not necessary to bring that up at all to start with, essentially giving this person an out to correct the mistake. With it now being clear that these things do get noticed, I'd think it's likely to not happen again.
But like I said, not sure if this is an appropriate approach for your specific situation.
