If you use a secret token you would compare the token from the first user 123 to what’s stored in the DB (for the second user ID) see that it doesn’t match and not log them in.

Because they used a signed user ID, there was no way to differentiate the user 123 from before the system restore and after.