If you think about it, your smart contact is attached to a specific UTXO. And somehow, in multi user environment, we need to distinguish the true smart contract output from other outputs that might also include this smart contact.
And the way we do this is to put an specific NFT on the output. Because an NFT can only exist once therefore is unique, there can only be one UTxO at the script address that holds the NFT and thus identities your smart contact.
This article from Robert Kornacki explains it in details, mostly:
(...) dApp UTXOs having no in-built uniqueness property which make
them clearly and reliably identifiable from others. This can be
potentially capitalized on by bad actors, or may simply cause problems
due to bad protocol design of new devs who are just getting their
bearings. This clearly is a major issue that must be addressed,
however we luckily have a great innovation which tackles this problem
precisely, NFTs.
(...) Because each NFT can only be created once and UTXOs have the ability
to hold tokens, this means that if we put an NFT inside of the UTXO of
the dApp we are deploying we can guarantee that no one else can do the
same. The NFT acts as an unforgable unique identifier that makes it
trivial for anyone and everyone to see which UTXO is the true
deployment of the protocol. Each dApp frontend must merely save the
currency ID of the NFT in order to be able to use it to verify that
any UTXO it finds at the smart contract address has the correct NFT
inside. If the UTXO does not, it is treated as invalid and ignored. It
does not matter whether the invalid UTXO was created by mistake or by
a bad actor on purpose, it is not the correct UTXO that we are looking
for and thus filtered out. To ensure that the uniqueness property is
forever held, the smart contract tied to the UTXO must specify that
the NFT is never allowed to leave the dApp. In other words, every time
someone spends the dApp UTXO, the NFT must be held in an output that
is also locked by the same dApp smart contract (this technically
changes in the context of dApp updates, but we can skip over that for
now). This NFT preservation check is the only code required to
guarantee the uniqueness property of the dApp. If this check is not in
place then it may be possible for a bad actor to steal the NFT and put
it in his deployment, thereby destroying all guarantees we had
originally.
