1) The Pokémon for another person's Secret Pals are programmed by the game.
2) While those aren't necessarily LEGIT Pokémon, those are his Pokémon, though I don't know what changes the boss' party.
3) You don't get notifications for Secret Base Battles. You won't even know if somebody battled you. Your character in a Secret Base is separate from you. It is actually an NPC that just uses your Pokemon.