Questions About Dynamic Internet IPs...

I have question about ISP assigned dynamic IP addresses.

For background, I'm a programmer working on a web application. For security reasons, I need to throttle access to certain parts of our web application. I want to make sure I have a solid understanding of how users are identified.

1. Is it ever possible for multiple ISP customers to share one internet facing IP address (e.g. through PAT)? Or is it strictly one customer to one internet IP.
2. On average, how long does a customer retain an IP address? Can it suddenly change in the middle of a web browsing session?
3. In general, why do ISPs reassign internet IP addresses? As I understand it, it's because internet IPs are limited, but If every customer is assigned an IP addressed at all times, how does the ISP save anything?
4. I noticed that I do not have an internet IP assigned to my home ADSL modem. When I perform a traceroute, I notice several hops across 10.X.X.X hosts before seeing an internet rotatable address. What's going on there?