Too many questions in one post .

I go for one. You have to access server/RetainServer to access your retain server.

In front of my network I use nginx. So I rewrite the link if RetainServer is missing:
location / {
    # Fix the “It appears that your reverse proxy set up is broken" error.
    rewrite ^ /RetainServer/;
    proxy_pass http://x.x.x.x;
    proxy_read_timeout 90;
}

I assume you have to do a similar activity in your environment.

Next one ...

No, Retain does not need a user in my opinion. Where do you see it?

Retain accesses GW via a trusted application feature.

And finally I take the last one (5).

As I remember you are right. Caching users cannot access external archives directly. Some time ago I had opened a case for this issue but support told me this is wad (working as designed).

I tried to find the text in the documentation, because I am sure I did not just make this up and create a user for no reason. Sadly, I cant find it again.

As to where I see it, here is a screenshot from the RetainWorker log at the beginning of a job. Some time has passed since installation but if I remember correctly, I created the user because retain was trying to log in with the first user it found (one that started with letter "a"). When a user named "retain" exists, it will be perferred over the first user in the post office alphabetically. See the first line in the screenshot.

And for completness, the user with a mailbox in the GW Post Office:

I cannot remember that I created an additional user for any of my Retain environments.

Maybe you did some extra settings in GroupWise Module/SOAP/Redirection Tables ...

Did you create a create a trusted application? And then you used this application key in your Module/Soap setting.