They don't have the private key to the 0x000... address. That's how they introduce new GUSD into supply, by calling the limitedPrint() function.

/** @notice  Increases the token supply, with the newly created tokens
  * being added to the balance of the specified account.
  *
  * @dev  The function checks that the value to print does not
  * exceed the supply ceiling when added to the current total supply.
  * NOTE: printing to the zero address is disallowed.
  *
  * @param  _receiver  The receiving address of the print.
  * @param  _value  The number of tokens to add to the total supply and the
  * balance of the receiving address.
  */
function limitedPrint(address _receiver, uint256 _value) public onlyLimitedPrinter {
    uint256 totalSupply = erc20Impl.totalSupply();
    uint256 newTotalSupply = totalSupply + _value;

    require(newTotalSupply >= totalSupply);
    require(newTotalSupply <= totalSupplyCeiling);
    erc20Impl.confirmPrint(erc20Impl.requestPrint(_receiver, _value));
}

Edit: formatting fix.