They guess/assume with some addresses, like Satoshi's or the EC2 instance that was destroyed with the private key and all the customer's funds haven't moved since 2012
Probabilistically, you probably can estimate that. Is a permanently dormant address just dormant or is it "burnt"?
To a degree, but there are some real whale accounts in question. Satoshi alone may have access to 1.1mm coins — or maybe not.