I'll take a stab at a few of these:
1: I'd check your raw access logs and AWStats to see what IP addresses are accessing your site, the block those individually.
2:What cron jobs are you running?
3: Unattached only means it's not inserted into a post or page, not that it's not being used. But, this shouldn't impact your CPU/RAM usage, only your webhosting size. One option, though, would be to offload those images to AmazonS3, there are a number of plugins that will do that for you.
4:Not an expert on this, but if you're in a shared hosting environment, GoDaddy should handle the upgrade, not you...?Maybe I'm wrong there.
Good luck,
Eric