Thanks! I found this place:
Each time a node sees a transaction it checks if it's the first time a public key used.
If yes, then soft remembers this key, so next user with the same account id will get all transactions rejected.
//Transaction.verify()
else if (account.publicKey == null) {
account.publicKey = senderPublicKey;
} else if (!Arrays.equals(senderPublicKey, account.publicKey)) {