(2) and (4) have the monetary incentive.
I worked with the team that fight spam, scams, and the fake accounts that distribute them when I started at Facebook, and they expend a lot of time writing code and building machine learning models to detect fake accounts. There would be no fake accounts if there wasn't a massive financial upside to it, and so they do the strangest things to try avoid the detection.
You can read a bit about what the team does at http://research.microsoft.com/en-us/projects/ldg/a10-stein.p...
The only way to spoof that is to expand the targeted audience.
The automated ad clicks that I refer to is demonstrated by a gaping hole in the data consistency, which would not otherwise occur if the action was taking place outside of Facebook's own servers.