The LastPass password manager stores One Time Recovery Passwords locally in each browser you use the plugin with:

<http://helpdesk.lastpass.com/account-recovery/>

My question is, how can you have more than one password?

I thought LastPass derived the encryption key from your master password using a variant of PBKDF2 and then encrypted your data with this encryption key locally with AES. There's no room in this scenario for multiple passwords, unless the data is encrypted multiple times. And, how can they enable or disable the OTPs unless they're stored somehow server-side? It just all smells really fishy. If the encryption key for my data never leaves my computer, I cannot understand how any password besides my master password could allow access to my password vault unless there's something LastPass isn't telling us and the local Javascript encryption is all smoke and mirrors...

**Update**

I contacted LastPass and they pointed me to an explanation here:
<http://forums.lastpass.com/viewtopic.php?f=12&t=22959&p=87289>