Scam contract “sending” tokens it doesn’t have control over.

This tx is one of many on a scam contract of some sort.

The tx details even on etherscan shows amounts of 0 tokens of various kinds being moved to/from addresses that the "sender" doesn't own. It links to the actual token contracts and everything.

Ledger Live doesn't show these transactions in the UI, but they are included as "0 XYZ sent by tx hash" when you do a history extract.

I realize no harm is done beyond maybe poisoning some address books, but why/how is it that these transactions on this arbitrary contract can seemingly send (but not really) tokens on other contracts, to/from addresses owned by other people?