How to provide encryption of user's data that can be performed by multiple (specific) users?
First of all, reuse of keys for multiple purposes is severely frowned upon when it comes to key management. If you just derive a single secret from PBKDF2 for authentication then you can still split it further into multiple keys / password hashes using a KBKDF such as HKDF.

Furthermore, if you want to decrypt data with multiple keys then you can simply create a random "data key" and encrypt that with the keys required.

If the key is a symmetric key then that key may however not be available, especially for the administrators. In that case you could just encrypt with a public key of a key pair generated for that administrator. You can encrypt the private key of that key pair using the symmetric key derived using PBKDF2 and the KBKDF. That way you only need the admin to log in when decryption is required instead of for encryption and decryption.



That said, I'd strongly advice you to hire a data encryption expert if you've got these kind of questions. There may be a lot of other requirements to secure the system.