I think it relies on the privacy-invazive zap flow, meaning your LN tip leaves traces in nostr events of who sent the sats.

Otherwise it wouldn't know the npub of the sender, e.g. who to send the DM to with the token.