run across an verify interesting account on browser, how to the holder spend it?

I run into a account on the browser.

https://solscan.io/account/41BJ8cmr4vaebFbHzxerb8YG6MmTFWLj15M6h65mUyiF

https://explorer.solana.com/address/41BJ8cmr4vaebFbHzxerb8YG6MmTFWLj15M6h65mUyiF

From browser we can see that it is off curve account. But browser show that it is “Assigned Program Id" to System Program.

How can one create account like this? An account assigned to System Program but off curve. How can the guy own this account spend tokens under it?