Hi Lisa,
1. Is it worth keeping all these (they want to add more) domains or let them expire?
If they are keeping them to help ensure brand security, then this is very popular and no harm in keeping them.
2. All the purchased domains are online - is there any point (they redirect with a 301)?
There is probably not a lot of point in all of them being live and pointing towards the main site as there will be no SEO benefit in doing this. If the sites were live and each had a site on there, it would be a different story and one that would end in a penalty.
If they are hoping to gain any SEO benefit from doing this, then they will be wasting their time. By all means they can buy them, but if what they have is delivering nothing beneficial (and I suspect they aren't), then I would just take them all down. It is more common to have a .co.uk and .com (and perhaps a few others) pointing to one key domain to capture traffic that types it wrong, but outside of this, it's a bit of a dead duck.
-Andy