Wikipedia says in reference to the elliptic curves officially recommended by NIST in FIPS 186-3:
Five prime fields for certain primes p of sizes 192, 224, 256, 384, and 521 bits. For each of the prime fields, one elliptic curve is recommended.
The first four bit sizes are immediately familiar from other cryptographic algorithms, but 521 seems to be the odd man out. Wikipedia even includes a footnote assuring readers that it is not a typo:
The sequence may seem suggestive of a typographic error. Nevertheless, the last value is 521 and not 512 bits.
Is there a cryptographically-sound reason for 521 bits instead of a more conventional power-of-two? If so, what is it — or if not, why and how was 521 chosen?