You have no choices beyond what you apparently are aware of. Modify the email or disable the scam detection are the choices. There are no hidden tweaks or settings is is really an incomplete feature that has languished for years.

Thank you Matt.

Is there any documentation of how my colleague could change the format of his mails that make it less likely to trigger Thunderbird's scam detection?

sure. The detection is very basic so all that triggers it is listed here https://support.mozilla.org/en-US/kb/thunderbirds-scam-detection#w_thunderbirds-automatic-scam-filtering

To summarize

• Links with numerical server names (http://127.0.0.1/).
• Links where the text doesn't match the server name (for example, the text of the message might say "https://secure.example.com" but the link actually goes to "http://phishing.example.com" instead). Phishers do this to fool you into going to their site. Unfortunately some legitimate mailing lists also do this with redirectors for tracking purposes.
• A remote image link that has different image source than the link points to (spoofing a legitimate web site, similar to the link spoofing described above).

Thank you Matt. Your hint helped me find the broken link "where the text doesn't match the server name" in the sender's HTML signature. Mystery solved, i notified my colleague!