Host key verification is done only after a connection is opened. As the connection is not opened at all from your colleague PC, no verification is done.

See https://winscp.net/eng/docs/faq_connection_refused

Hello. In my work I need to use SFTP connection, but I have a problem with that. I can connect only from my PC, but my colleague is unable to do it. He is getting "Connection refused" error. We both use the same username and password for this connection. I tried to log in to his computer with my credential but it also does not work. If he log in to my computer it works. I noticed, that if I try to connect from my PC, I have to agree with RSA fingerprint but he not. So I think, that he has blocked the public key, is it posible? We both are using portable version. Do you know where can be the problem?