I think the reason is that what it is passing is just an expression of type Expression<Action<IService>>
and the arguments in the expression are captured (so if you changed the value of expectedValue the value in the expression changes too). Of note is that the expression is identical if you make it with a normal parameter instead of an out parameter.
I think probably it is just not doing anything to that parameter at all. When you setup the method you put a bunch of metadata in the Mock object telling it what you've done and when you call the method on your mock object it uses that metadata to work out what the return is or what else it might need to do.
Of note is that it probably isn't calling anything and passing it your parameter with the out modifier so the result is basically the same as if you didn't have that line, that is Mock just doesn't even try to set a value of that variable. This means that basically you set the value of expectedValue
when you declare it and then nothing changes it and then you have an assertion based on it.
I'm not in a position to do any testing to prove this theory and I am not confident enough in my understanding of expressions or Mock to say this is definitely what is going on but from what I've seen of the code I think its at least close to this. My uncertainty was such that I was going to post this as a comment but it is a wee bit too long. ;-)
Having said all of that even if Mock is doing something with it the reason it can read your variable despite being an out parameter is that it is part of the expression. You should be able to see this by using the following code, setting an appropriate breakpoint and inspecting:
string expectedValue = "FNORDFNORD";
Expression<Action<IService>> expression = s => s.DoSomething(out expectedValue);