1) It deals with it well. There's no issue running one or more nodes on a single host or machine. It's been done that way before SMP was made nicer a few years ago. The distribution mechanism is based on a name@host scheme so as long as the total pair is unique to a cluster, things are usually fine.
Running one VM per machine has a few upsides: better resource handling (large binaries are shared on a heap rather than copied), copying within a VM is cheaper than serializing over the network, and so on. The downside is lower isolation.
For this reason, people will tend to bundle a bunch of services together if they relate to the same general logical block of applications. You should definitely be able to find a way to run your Erlang code around with RabbitMQ (though that depends on their compilation process and assumptions as well).
They'll keep them separate for operational purposes often: some code bases are less mature, require more ops, crash more often, and so on, or have more erratic behavior, and so isolation is welcome in these cases.
2) See http://www.erlang.org/doc/man/config.html, http://www.erlang.org/doc/man/app.html, and http://www.erlang.org/doc/apps/kernel/application.html
Erlang comes out of the box with a configuration mechanism, which you may or may not make mutable at your choice on a per-application basis.
3) That's one way to do it, yes. This one or equivalent ones (restricting network access, IP tables, etc.) are the most used ones as far as I know. Some mechanisms can also include running an SSH daemon on the node and only allowing people with the right credentials to connect to a node. There's one that ships with the Erlang/OTP distribution.