How does systemctl schedule system shutdown?

Good question. I tried what I now realise you must have tried- scheduling a shutdown and querying the systemd timers!

That showed that the shutdown was not in the systemd timers, as you noted. So then a quick perusal of the systemctl source gives us this call, as part of halt_main():

r = sd_bus_call_method(
                       b,
                       "org.freedesktop.login1",
                       "/org/freedesktop/login1",
                       "org.freedesktop.login1.Manager",
                       "ScheduleShutdown",
                       &error,
                       NULL,
                       "st",
                       arg_action == ACTION_HALT     ? "halt" :
                       arg_action == ACTION_POWEROFF ? "poweroff" :
                       arg_action == ACTION_KEXEC    ? "kexec" :
                                                       "reboot",
                       arg_when);

(systemctl.c line 7387)

So it would appear that shutdowns are handled by logind. You can continue to pursue the details if you like- see login-dbus.c. There are methods there for scheduling, cancelling, managing shutdowns. But for a deeper understanding, you may need to know more about logind/systemd than I do.

Long story short, the shutdown info is stored (at least) in a schedule file at /run/systemd/shutdown/scheduled, the contents of mine as an example were:

USEC=1435715559055789
WARN_WALL=1
MODE=poweroff

Indicating time (in microseconds, presumably); whether to warn via wall, and which mode (cf restart, kexec etc).

Hope this points you in the right direction at least!