1. Go to Signup Allowlist (/admin/signupallowlist, no menu link — direct URL only).
2. Under Allow an address, enter their email (or a whole @domain.com to whitelist everyone at that domain) and a note describing why (e.g. a ticket number).
3. Click Add to allowlist.

Or, if they already show up under Recent blocked signups, just click Allow on their row — it adds them with an automatic note ("Allowed from blocked-attempt list").