Only the 1st acidic proton is strong, not the second.
More importantly, protons dissociate from and associate with the
conjugate bases rapidly all the time. It’s dynamic.
The HSO4- ion is nucleophilic (since it is
basic, albeit also simultaneously acidic), and hence can attack the
carbocation intermediate.