They don’t. They’re using another phone and texting the original owner, threatening them, in order to scare them into unlocking the device.

When you boot the “Lost” phone, it asks for the password of the owner’s iCloud account. There is probably an information leak where the original email or phone is presented and the thief can track the original owner through that.

The original iCloud email address is partially obfuscated “eg. e***@icloud.com”, so it’s unlikely to be useful.

For this, they’re most likely reading the phone number from the physical SIM card left in the device.