In many jurisdictions, it is legal, but businesses should be transparent and comply with privacy laws.
Yes, they can be, as the context of posts may not always provide a full picture. It's important to interpret findings judiciously.
The timeframe varies, but it's common to review the past 1-2 years of online activity.