I mean cashu ofc. Stupid autocorrect.

Is it a possible? Not sure, but haven't seen it in practice.

Yes. Every time a token is spent (including when it’s swapped for a fresh one). Otherwise, an attacker could keep swapping it and bloat the database.