1) If they have the know how...yes
2) Yes as they would be stealing your bandwidth though depends how often and how much.
3) Yes,your routers configuration pages should/maybe show there mac address that you can block easily.
Basically to stop any of this,secure your router immediately.
Some advice click here