hi, I wonder how TON check the ownership of an NFT. What I see in the smart contract is just something like: throw_unless(401, equal_slices(sender_address, owner_address));

What if someone crafts a message and states that he is the owner of the NFT and he would like to change_owner to his second wallet?

you can also find that in collection contract, so that only deployer of collection (or owner) can deploy the nft.

but if you remove that part from collection and deploy the nft with account (let A) that is not owner of collection, you can make nft whose owner is A.

but you should not remove throw_unless(401) part of nft contract because it maybe about ownership_transfer

It's impossible to spoof the message sender