The flash chip controller contains some settings. Product ID, Vendor ID, and number & size of flashchips.
By taking an older device with a small chip, overwriting the firmware with an wrong number of flash chips, the total drive capacity will be larger than de number of installed flash.
Because the amount of adress lines has not changed, the chip will always be written to. For example, first 128 MB will be written, then the next chip is selected, then another 128 will be written.
Because there is only one chip, the select line is not connected and the second flashchip data overwrites the first chips data.
Because the controller reports the size of all the chips, including the not connected ones to the OS, the OS will happily format it the wrong size.