Here's a battle I had over Random Matchup that was full of hax.
13-19664-79884
I haven't had many battles as ridiculous as that one. It was fun to watch how it played out, though.
It seems to be alright. It's always possible that the person didn't have any other balls at the time and had no choice but to use their Master Ball. That, or they didn't want to risk fainting the Gulpin. Either way, it's still most likely legit.
Yes, that would be the best way.
You don't need to add the EVs to anything, but the extra points gained from the EVs are added to the Pokemon's actual stats.