1. Yes.
2. If it stales, it could be that Data Collection is not running properly (there is a bug in CM 5.2.1 where this can happen if wireless devices are in the network), or it could be that the end host could not be found. The log would be ut.log for UT acquisition, and ani.log for Data Collection.
3. If the user power downs their host before UT acquisition can see it, then the last seen field will not be updated. This kind of thing is why we added Dynamc UT. Dynamic UT allows UT to get notified when users enter or exit the network in near real-time.