I think you'd need to put a LDAP replica per location too.
1. yes : the mail stays "local"
2. configuration can be made only by the admin. Whoever is admin can change it, it's not relation to a location.
3. each mailstore/mta will build its own spamassassin database. But the spam levels are allocated globally (through the admin webUI)
4. if you're using NE, you can define a domain admin for each subdomain and let these domain admins handles "their" local accounts.
You might want to check this discussion too :
WebMail proxy