1. If he has your database - that's all he has. Nothing more, nothing less.
2. No, unless he has multiple copies stored on your server.
3. You do know how hard it is to sniff someone's packets, right?

4. If you have a dynamic IP, no. But if your IP is static, yes.
5. Errrr, you already said you knew, didn't you?
6. Get another virus scanner? In any case, you won't get a virus if you're careful what you're doing online.