Response message come on the tunnel formed during Create Session Request handling.
So, MME, SGW, PGW keep a tunnel record with them, in which they store numerous parameters like Tunnel ID, UE Record, Peer Record, etc.
Inside UE Record, which gets allocated during Create Session Request handling, IMSI is also stored.
When Create Session Response is received, based on the TEID, the corresponding tunnel record is looked up and IMSI is fetched from UE Record inside tunnel record.
Hope this is clear.
Nodes also keep transaction record to store additional information like for which bearers request message was sent. But transaction record lives only till response is received, and deallocated afterwards. Whereas tunnel record lives till the entire call gets disconnected (through DBReq, DSReq, local purge, path failure, etc.)