How does Drupal handle concurrent user creation?
How is it possible that Drupal uses no transaction management?


It's not. The code you're querying is part of user_save(); the very first line in that function is:

$transaction = db_transaction();


The rest of the function is wrapped in a try...catch that explicitly rolls back the transaction upon exception. The same is true for node_save(), and plenty of other core functions that require transactions.

See the db_transaction() docs for more info.