If you want an 'open' explanation of how the One-Time-Password is derived you can read about the Oath standard and the specification for the algorithm here, http://www.openauthentication.org/specifications. The Vasco/Digipass product supports this specification, and it may be used by your token in this case, however they do support other OTP generation algorithms.
Typically the serial number of the token is maintained as a record in the authentication server database, and the serial number is assigned to a username. The serial number is also matched to a 'seed' value, which when combined through the algorithm with the time/sequence value derives the OTP.
Also, you were able to punch in a PIN over and over and be authenticated because the authentication server will allow for a couple of minutes of clock drift. The token you have has a clock built in to generate the time based component. The server generates values for a range of time. It then can see which code you submit, and write a drift value to your record. Some systems will have a 'next-tokencode' mode, which is used if the clocks drift too far apart. The system will ask you to submit two values and see if they are correct and in the proper order, over a larger 'range' of time. If the values are correct the authentication server can write the clock drift value to the record.