Reentrancy through safeMint

A mint function limits each address to 1 NFT. An attacker's contract ends up with 20. How?

function mint() external {
    require(minted[msg.sender] == 0, "already minted");
    _safeMint(msg.sender, nextId++);
    minted[msg.sender] = 1;
}