To be able to afford the costs and still make a profit hosts start overselling. Overselling is basically selling more than what you can provide. In this case instead of putting 30 customers on a server, they put 300 customers. This is done based on the assumption that no user will use all of their allotted space and bandwidth.

Does it work?

Absolutely, even the electric company does it, based on the assumption that everyone won’t turn all their electronics on at once. This can only be taken to a certain extent before it starts becoming a problem, and the server starts getting overloaded. So what happens if everyone actually used all their bandwidth and disk space? Nothing, because the Terms of Service and Acceptable Usage Policy don’t allow it. If you read these two pieces you will find that every host has a clause that mentions CPU and Memory Usage. You will most likely hit these limits far before you hit the space and bandwidth limits.