Q1.
I'm not a domainer, but it's been my general experience that trying to negotiate directly with the owner has a much wider range of risk/reward. In other words, you might be able to contact them and get it for $250, or they might be completely insane and want $250,000 for junk, even though every other person on earth knows that's ridiculous. With the fixed-price sales, you can at least make that decision of whether it's worth the price tag for you.
That decision, though, isn't primarily an SEO decision, IMO, it's a business decision. Paying $1,000 for the right domain could be an incredible bargain if this site is your bread and butter and the name is critical. It could be a huge waste of money if this is your personal blog and a hundred different names would do just as well. It's really hard to advise you in a vacuum. If you asked me if $1,000 was a good price for an iPad, I could confidently say "no", but the value of a domain is highly subjective.
Q2.
I don't believe there's any kind of outright penalty. Hyphenated domains do often correlate with spammy domains, and it may be one signal of many Google considers, but I think they look at it clustered with other factors (that's speculative on my part). So, if your domain looks spammy on other dimensions and you've got a hyphenated, keyword-loaded domain, then yes, it might cause you problems. I don't think you'll get whacked just because of the hyphens.
I do think that hyphenated domains have a general trust issue with humans, though. It's not insurmountable, but I tend to agree with Michael -- there's always a non-hyphenated variant or an alternate TLD (even a .co) that's worth considering. Unless you're Eugene's Discount Widgets and your board will not settle for an domain but a .com with those three words in it and no other words, there are probably non-hyphenated options worth exploring.