The short answer is "one;" workflow rules are invoked when a DML event occurs, either an insert or an update, regardless of the origin of the DML event (but there are some limited exceptions, such as meta-data updates). Written more verbosely, there are a number of ways that a workflow rule might be invoked: when a user creates or modifies a record in the UI, when a user creates or modifies a record in mobile edition, when a user creates or modifies a record in a third party integration, when a user uses an import wizard, when the bulk API is used to mass insert or update records, when the REST API is used and a record is created or modified, when the SOAP API is used to insert or update a record, when a Visualforce page controller inserts or updates a record, when a trigger inserts or updates a record, when a Scheduled class inserts or updates a record, when a Batch Apex Code class inserts or updates a record, when a Portal user inserts or updates a record, when an asynchronous call inserts or updates a record, when a workflow outbound notification message triggers a service that inserts or updates a record back in salesforce.com, and so on. I'm fairly certain I am missing every possible example, but the point here is that there are many operations that cause DML operations, and any one of those operations can invoke workflow rules.