Few thought,
1. About idea number 2, people who already sync their Bitcoin Core can open console and run command rescanblockchain in order to see all transaction related to a wallet.dat file.
2. About idea number 3, the transaction will occur (as in included on Bitcoin block) as long as the address has valid format/checksum.
3. If you find someone try to sell wallet.dat, it's likely it's fake. After all, they could attempt to recover the Bitcoin either by hiring professional or rent hardware to brute force it.