The backing bean gets a handle to the current user session state because the state is injected into the backing bean via the JSF managed bean facility.
By looking at this generated source code in the JSP, you see that the data table has been bound to a data method in the JSP's page code file (a backing bean for the current page).