CheeToS, that was his problem for #2, he was doing it serversided. So you really DID know where he was going wrong
As for #3, try giving the NPC some rupees to start with before it lays.
Since they're clientside, they're vulnerable to trainers, and therefore it requires that the player drops rupees. This is an effective way to stop hacking.
Since I haven't used it with an NPC laying its own rupees, I can't say whether or not it will work. However, I think it is a good place to start.