1. They are owned by the $user:$user. The document root is owned by $owner:nobody
3. Some or even all should be accessible directly.
4. I will check that.
5. That could be a good idea. It could be verified, when somebody will try to use FrontPage Extensions for his site i.e. it will access the _vti_bin dir.