Moz doesn't pick, just signal the duplicate content. If you add the canonical Moz should understand and un flag it as duplicate.

I don't know which CMS/framework you use but it's unlikely you can set canonical at template level.

Also my direct experience tell changing the image name greatly improve image ranking in serp.

If you are not changing the IP address you don't need to change the DNS, if you change the IP address, in addition to updating the DNS records you also need to properly redirect traffic from old urls to new urls.

With IIS the best option is using url rewrite, which is very flexible but a little tricky to set up if it's the first time you do so: http://www.iis.net/learn/extensions/url-rewrite-module/creating-rewrite-rules-for-the-url-rewrite-module

Url rewrite does operate at web server level, its powerful and does the job, but you may consider doing redirects at application level, depending on the technology you use, php/dotnet/aspx/mvc you have different tools. The advantage of doing it at application level is you can redirect dynamically, in other words use an algo to translate the old urls to the new ones using whatever information is stored in the application cache, database, and so on. While using IIS url rewrite you either statically redirect each old url to a the new url or you use regular expressions or wildcards to dynamically do so. In other words using url rewrite you have a little less flexibility.

What percentage of page content would be duplicate?

I am asking because I remember seeing a video of our spiritual guide Matt Cutts addressing that, and he said at google they do understand content sometimes is quoted, cited, etc... And it all depends on how much text is duplicated when you quote, cite...

But unfortunately he was not saying how much is too much.

Maybe I am missing something, but form submission is either PPC or organic because the visitor is coming from PPC or Organic. So if you define a goal in analytics for the form submission, triggered either by url match or javascript, you can later check in analytics how many lead were generated through PPC or organic checking the goals per channel/referral/campaign.

https://www.google.it/webhp?q=google+analytics+goal+form+submission#q=google+analytics+goal+form+submission

Keep in mind you can use utm_source, utm_campaing, etc... In the links originating the leads, if you control them.

Check my answer to a similar question: http://moz.com/community/q/angular-seo

I am a big advocate of Angularjs, it's a great framework and I use it in every project. I always put SEO on top of my priority list when starting a new project and I never use hashbangs.

In my opinion hashbangs are fundamentally wrong, an old hack born when pushstate was not available.

The only case where Hashbangs make sense is for old complex application/javascript website developed without thinking about SEO, when you evaluate to modernize the app is too complex and not worth it.

You can happily use angularjs and benefit from its routing api without messing around with hashbangs.

You need coding, when the visitor land on the entry page of your site take the utm_source or utm_campaign from the url and log where he is coming from, in a cookie, session variable, etc... Then pass it through on form submission. You can use header, footer or any wordpress piece of code used in every page.

You can't keep the query string through the visitor path unless you code too, and it's more complex, and I don't believe you can find a wordpress plugin doing that. For sure is not something you can do with a standard wordpress installation.

You can use either one or another, cookie is persistent through different visits (and last as long as you decide it to last), while the session variable last only for the current user session. Depends on the attribution window you want to use.

But, in the first place, why did you choose to NOINDEX, FOLLOW those product pages?

If you have a preferred product page among those different variants seen as duplicate why don't you just use canonical to point there?

What do you think is the benefit of noindexing? Theoretically leaving them there with the duplicate content and a canonical you are wasting some google bot crawling budget, but unless you need google to crawl your pages with a high frequency (because your content is frequently updated) I wouldn't care much.

Personally I see de-indexing as the last resort.

Check webserver log files, or log visits (ip address, user agent, __utma, __utmz, possibly browser fingerprint, etc...)

Analyzing those you can easily find out if the traffic is from scraping bot or humans.