The only way he could have gotten the key is if the portal to the next level was up (as far as I know). When you click that small rectangular button to connect to a realm/dung what the client is essentially doing is requesting the need information to connect to said realm/dung. By default, the client is programmed to automatically connect to the realm/dung when it receives this information. You could however save the information and not connect to it till later (within the time the portal key is good if it needs a portal key).
would this mean you could store the portal key from your vault and then connect to it at anytime? or does the portal key change from time to time?