How is hash160 calculated from an unseen public key?
Because an address is the Hash160 (=RIPEMD160(SHA256(x))) of the public key. The transaction output lists that 160-bit hash directly.

When redeeming such an output, you provide both the public key (which must hash to the value given in the output) and a signature (which must be valid for the given public key).