I've had some experience with this area and asked similar questions to Salesforce.
"For b) my guess would be there is no impact on custom object count as its a managed package."
Yes providing your package has Aloha status (which requires Security Review to be passed).
"For a) I'm not so sure, is 10MB a hard limit for the org and is set 'high' as it is expected this limit will not be hit across all managed packages and customers customer settings combined."
Public and Private custom settings also share this regardless. My notes from the last time I discussed this with Salesforce indicate this is scoped by namespace/package. Though I note the documentation does not reflect this, I would raise a support case to confirm this.
"What happens if there is 3MB of custom settings data and only 1 user in the org (so only 1MB of custom settings data is allowed)?"
When you reach the limit you will receive a run time exception from Apex code and a mesage in the UI if creating manually. According to my reading of the docs one (licensed) user will only result in 1MB of maximum cache for settings. Hence the 'lesser' highlighted in bold in the docs.
The total amount of cached data allowed for your organization is the lesser of these two values:
10 MB
1 MB multiplied by the number of full-featured user licenses in your organization
For example, if your organization has three full licenses, you have 3 MB of custom setting storage. If your organization has six full licenses, you have 10 MB of storage.
Custom Setting Limits.
Salesforce backed out this across-the-board change and made it a versioned changed. API Version 31 and earlier will continue to return the session ID from UserInfo.getSessionId() when in the Sites guest user context. Your VF Page and Apex Controller must be Version 31 or earlier.
The patch hit the Winter '15 sandboxes last night (Sept 30) and will hit the only production instance (NA1) currently running Winter '15 tonight and will be included with the rest of the pod upgrades on Oct 3rd and Oct 17.
(This is not documented publicly as a Known Issue nor included in the Release Notes)
Best Answer
I seems that they count against your API limits described here: https://help.salesforce.com/HTViewHelpDoc?id=integrate_api_rate_limiting.htm
Go on reading here for more details: Understanding Rest Apex and Webservice Limit