The DispatcherServlet, which is the entry point of any Spring MVC application, creates a new ModelAndViewContainer object on each request. The javadoc for this class states 
Records model and view related decisions made by 
  HandlerMethodArgumentResolvers and HandlerMethodReturnValueHandlers
  during the course of invocation of a controller method.
Those two interfaces are what handles resolving your @RequestMapping annotated method arguments and return values. 
So, during the lifecycle of the request, the model attributes are stored in a ModelMap field of this ModelAndViewContainer object. The actual, current, implementation is a BindingAwareModelMap.
Towards the end of the request, when a view needs to be rendered, some View objects will merge the model attributes with the HttpServletRequest attributes.
How the EL works to retrieve the stored values in the model?
It doesn't. EL resolves the attributes from the JSP's page scope,HttpServletRequest, HttpSession, or ServletContext.