Tbh there should be more thought into this system, thus far it's causing issues.
I guess those VW keys are probably being generated from a hash function and goes directly to valid keys table without one-to-one relation(Means those keys are not matched to a single user when generated and sent to database and categorized for the group).So I can use a key which was sent to another person and this key belongs to me since I matched it to myself.If that's the case,its quite bad.