No one owns random strings. They can claim whatever they want to be "their" tokens
This is fundamentally similar to how UPS, DHL etc. document how to recognise their tracking numbers.
"Their" and genitive in general doesn't necessarily mean ownership. It's often used for various sorts of connection. For example, "my address" doesn't claim ownership of either the street or the house, "my age", "my wife", all connected to me somehow but not owned by me.