What does this comment in the PHPMyAdmin source code mean?

PMA_token is, as the comment states is being used to authenticate access queries. One can carefully study it from the source-code. The spaces before and after the name are clarified in the comment you've quoted:

(we use "space PMA_token space" to prevent overwriting)

Using spaces inside array keys is not a good or bad practice perse. Nothing prevents you from doing

This means that it can be overriden. So, from the comment we see the developer presumed that prepending and appending space to the name will prevent the name from being overriden, but not because it would offer a special protection. The actual reason must have been that it's hard to imagine someone defining PMA_token as a name with space before and after the letters, but one could add arpad to any name of an array and it will be very unlikely that someone will override that.