The main identifier of any contract is not the metadata associated with the contract, but rather the contract address. Etherscan and other clients will use the address as the identifier for the token. Anybody can make an exact copy of paste of any contract, but nobody can do so with the contract being deployed to the same address.
In the case of Etherscan choosing which token is the real token, they accept a form from the entity creating the token that states the associated website, GitHub, etc. that go along with that token. The reason the real token comes up first in Etherscan searches is because of sheer traffic and interest in that specific token (read: address)