OAuth is an authentication mechanism, meaning it implements a principle of logic stating that a subject is who he/she claims to be (authN), and then asserts that to a relying party (authR). In other words, OAuth establishes identity.
OAuth is a mechanism by which an application can be granted authorization by a user to another application.
The identity question is not in any way addressed by OAuth. It is up to the application implementation to handle identifying the user creating the grant.
The link you provided basically establishes the same problem which is always the case - if someone is watching your (unencrypted) traffic, you're hosed.
That authorisation is an assertion of identity. This makes OAuth an identity system inasmuch as WS-Federation and the SAML protocol are identity systems. Technically they're parts of an identity system, making them identity meta-systems.
Maybe, but that has nothing to do with OAuth. One could be completely within the OAuth spec and allow one user to provide grants to act as dozens of other users. You are basically saying that OAuth is not good at something it was never designed to have any say about.
It's as though you're saying that your rolling pin doesn't work well as a meat tenderizer. Yeah, I guess they're related, but that's not what a rolling pin does.
Your question about MITM is answered at http://www.subbu.org/blog/2010/09/oauth-2-0-and-cookie-conve....