1) makes sense if Levandowski did it over the company internet connection. There could be a record of his unusual requests (software download, software update).

> they can infer that he wiped it

For 4), Levandowski reformatted the hard drive before returning it, so there's no inference there.