The token md5 generation doesn't check that the generated md5 hash is unique, but it should (the field is set as UNIQUE in the database).