Hello Heng
You are correct that the Hub router does know the NBMA of spoke 2, however, when an NBMA request is sent, it must always be answered by the owner of the specific address. In this example, Spoke 1 doesn’t have the 172.16.123.3 address in its NHRP cache. It sends out an NHRP resolution request. The resolution request is not sent to the Hub as its destination, but is sent to the hub as the the path to the destination , that is, via Tunnel 0.
The NHRP resolution must always be answered by the owner of the IP address in question. In this case, it must be answered by the device with the NBMA address of 172.123.3.3, which is Spoke 2. This is why the request is forwarded to Spoke 2 and Spoke 2 is expected to answer.
I hope this has been helpful!
Laz