If you take a look on the HTML form generated using Web-to-Lead, you will notice as below:
<form action="https://webto.salesforce.com/servlet/servlet.WebToLead?encoding=UTF-8" method="POST">
This signifies that its a POST request made to a servlet hosted on Salesforce servers which does not need any authentication (in this case). So from the Web, you just post the request to this servlet. There is no REST or SOAP API call that is made here.
The incoming request is then captured and translated to a Lead record in Salesforce, where the record owner is pre-defined when you first enabled the Web-to-Lead in Salesforce. So irrespective of from where the web form was submitted, the leads created will always have the owner as defined in your settings.