Would using a one-time pad multiple times with some conditions be safe? I understand why |one-time pad|=|message| using a normal one-time pad, but I don't understand why for perfect secrecy it must alway be that |key|>|all messages exchanged|.

What if, for example, I had |one-time pad|=n*|message| with n>1 and then used it for (for example) 2n messages with a random starting point (itself encoded at some point in the message with a 'normal' one-time pad which given it's a single number could be simply be the first part of the original OTP)?

I'm pretty sure there must be something that doesn't work, because if this was still perfectly secret then a one-time pad could be used to generate infinite one-time pads which would be useful but impossible (wouldn't everybody be using it?). So, where does the perfect encryption of the one-time pad end?
For perfect secrecy of any cryptosystem, it must hold that |key|≥|all messages exchanged|.

Proof by contraposition: assume |key|&lt;|all messages exchanged|, and there exists a deterministic decryption procedure of all ciphertext exchanged and key to all messages exchanged. Knowing all messages exchanged, an infinitely powerful adversary can exclude some value of messages exchanged as impossible, violating perfect secrecy; all s/he has to do is apply said procedure to decipher the given all ciphertext exchanged with all the possible values of key, and rule out as impossible any value of all messages exchanged not obtained for any value of key. The hypothesis |key|&lt;|all messages exchanged| implies there will exist at least one impossible value, by a counting argument.



In the case of the repeated OTP in the question, there exists attacks that can be performed by an adversary with very limited computing ability, and enough knowledge about the plaintext.

For example, assume that all the messages are long, random, and known entirely except for an unknown bit in the middle of the last message. It becomes likely and easy to find most of the key, and the starting point for all messages, and from that the single unknown plaintext bit.

There are more clever attacks that work with less hypothesis on the plaintext (like: it is mostly English words), and remain feasible in practice if there is enough ciphertext.