If necessary, a derived contract can add a baseURI state variable and an update function.
In some cases it might be simpler to manage each tokenURI separately. For example, suppose you mint tokens regularly, with different metadata each time, and you want to host that on IPFS. In this case it might be easier to just upload a new file to IPFS and use setTokenURI for the minted token, otherwise you would have to update the entire metadata directory on IPFS and either change IPNS to point to the new directory, or change the base URI on your contract.
ipfs:// URIs work the same way. In my example it would be ipfs://QmcP9hxrnC1T5ATPmq2saFeAM1ypFX9BnAswCdHB9JCjLA/1.
In the Pinata main page, when you click "Upload" it offers an option to upload a Folder, instead of a File. This is what I used.
I'm not sure who your users are or what they should be able to do, so I don't know what the workflow would look like for them. As I said above, if you're going to be minting NFTs dynamically, using a single base URI may not be the best option for your use case, and ERC721URIStorage with setTokenURI may be a better fit.
Yeah I don't think there is any other way. You need to somehow trace an NFT back to its alleged author. It can be as simple as the author posting a tweet saying they have created this NFT, though then you would need some way to verify that their Twitter account was not hacked.