How can two different passphrases unlock the same content? I have heard that in enterprises it is common that the IT admin has a master passphrase that can unlock any content that an employee encrypts.

It would be temping to think, that the IT admin's passphrase is encrypted with the employees passphrase, but then the IT can't change his passphrase.

How does such encryption actually work?

Is there a cryptographic secure method of doing this?
Another method to the ones described above would be ID-based encryption where a trusted third party, called the Private Key Generator (PKG), generates the corresponding private key based on the user's identity (whether it be domain name or email address).

Given the master public key, any party can compute a public key corresponding to the identity ID by combining the master public key with the identity value. To obtain a corresponding private key, the party authorized to use the identity ID contacts the PKG, which uses the master private key to generate the private key for identity ID.  If only part of the master private key is used to generate the corresponding private key, then the PKG can generate two private keys by using different parts of the master key.  That way, the user will have one private key, and management the other.

Whether or not this is secure depends on how much you trust the third party PKG.

For further information, have a look at the following link.

ID Based Encryption

Also have a look at the following article:

Identity-Based Encryption from the Weil Pair

If you do a search on the title, you should be able to find the associated PDF.