4 - then hacker/exchange (or anyone aware of the hack before announcement) could easily drain entire inchain's capital
Most of those questions I dont know the answer to but they have stated there will be some mechanisms to prevent abuse. You also have a human insurance comittiee.
It shouldnt be possible to drain all the capital. The risk will be split between the exchanges so all the capital wont/cant be tied to a single exchange. But it is a potential exploit that they need to consider.