For question 3, the short version: do nothing with it yourself, and tell your bank.
The reason is that you have no way to verify any of the story. You cannot tell a genuine fat-fingered transfer from stolen funds by looking at your statement, and neither can the person messaging you: who may not be the sender at all.
Your bank can. A misdirected payment has a defined process: the sending bank raises a recall, your bank asks your permission, and the money goes back through the same channel it arrived by. That process leaves a record showing you cooperated, which matters if it later turns out to have been stolen.
What you should not do is spend it. Money that arrives by error is not yours to keep, and the reversal can arrive weeks later: into an account that no longer has it.