You can create multiple public keys from one private key. Exchanges control the private key but you control the public key. Rember that a blockchain keeps a record of spent and unspent transactions - there is technically no coins "in your wallet" - your balance is the difference in these two numbers.
When ETH is transferred to your public address, it is tied to your account through the exchange's DB, and the fact thay the receiving private key can reproduce and transact for all public keys but not the other way around, you could never "tap into" the other users public keys that were created from the private key. The public address is visible on the blockchain, so the network can confirm the change in transactions for your specific address, but the coins are linked to the private key (exchange).
When you sign up for an exchange you accept a public wallet address that pulls from and sends to a private address which is held by the exchange. Your balance is available because the public keys also provide transaction data and that is what is linked to your account.