I can’t answer the first question, other than to say “often enough to have a process to handle it”.
As for the second one, with bin/lot tracking you can identify if the item had previously been returned. Employee theft doesn’t usually involve putting bricks in it within a DC - it’s usually easier and less risk to take the whole box (and maybe get rid of the packaging in the toilet, at a warehouse I used to work at someone was found to be stealing iPods because a lot of packaging was found behind a toilet ceiling tile). If the item hadn’t previously been returned, this would usually infer that the customer was lying about receiving it with a brick in it (although obviously there is the possibility that it came in that state from the supplier).
The usual assumption is that the supplier didn’t send it in with a brick, because otherwise customer fraud is too easy - but occasionally that assumption is wrong, which is probably what happened in this case.
They probably checked there was no return in the history, made the assumption it wouldn’t have come empty from Canon, and figured it was the customer that lied.