You are correct that in p2p networks, you cannot use the same DLCI value to map difference remote address via separate subinterfaces. The key difference with multipoint FR is that, unlike p2p subinterfaces, the frame-relay interface-dlci command can be configured multiple times to associate more than one DLCI to THE SAME multipoint subinterface. What's confusing you, I think, is that the second address being mapped in your R2 example is a BROADCAST address. On a multipoint subinterface, either the "frame-relay interface-dlci dlci" or frame-relay map protocol protocol-address dlci [broadcast]" commands can be used to associate the multipoint subinterface with specific DLCIs. The "frame-relay interface-dlci dlci" command performs dynamic address mapping using Inverse ARP to map the next-hop protocol address to the local DLCI on the router.
The key is to understand that multipoint FR networks can use broadcasts to direct traffic to a specific remote node. That is what is happening in your example.
