In the answer to this question, it is stated that:
Rearranging this equation you get rP = sR - mG, or P = (s/r)R - (m/r)G. Thus, it seems we can just compute the public key from the message and the signature. Unfortunately, there can be up to 4 different points R for which R.x mod n = r (in practice, the number is almost always 2).
How is it possible that there could be up to 4 different points for R? And why would it most often be 2 different points?