Why and how does excessive headspace open the action?
The Marlins, in particular, use angled faces on the locking bolts. Since the rifle isn't actually locked at the moment of ignition (the hammer pushes the bolt forward against the case head), the bolt slams backward when the case expands. When it his the angled face of the locking bolt, it kicks the locking bolt down and into the lever. Thus, popping the lever open.
Reasonable illustration of the Marlin action:
Marlin 336
With REALLY bad headspace, severely worn parts, and overly-hot loads, several members on the MarlinOwners forums have had their fingers injured superficially (nasty abrasions or even cuts).
The Winchester 94s use a different method for lockup, but the situation is similar. The engagement surfaces are angled and the locking block can be forced downward (pushing the lever and lower link ahead of it) if the bolt slams into it - particularly if the rifle is well worn, is severely battered from being fired in that condition for some time, or has been 'improved' by some idiot filing the locking bolt in their shed.
(I can't find a satisfactory image of the '94 action.)
With Volcanic style (toggle-link) lever guns, such as the Winchester 73, Burgess, Volcanics, and more, the excessive headspace is usually caused by worn links or link pins, which result in improper lockup. (Actually creating an "out of battery" condition, even if only slightly.) Those worn links and incomplete lockup can have the same end result: Levers getting kicked open.
It happens in the Volcanic style actions, because the toggle links get worn enough that they're no longer forming a straight line and mechanical lock between the rear link that's attached to the receiver, and the front link that's attached to the bolt. Rather, they're "sagging" in a shallow "V" shape, and they direct the bolt thrust into the center pivot (which is where the lever attaches). When that center pivot gets forced down, the lever opens.
Decent video of a Volcanic style action (Win 73):
YouTube Video