The router knows where packets belong because The router saves ... an address translation table. It remembers what inside-outside address translations it has made. As such, one inside address equals one outside address, and the destination is irrelevant. This, of course, ignores the firewall present in practically every NAT router, which tracks full connections:

(inside) src:ip+port,dst:ip+port <-> (outside) src:ip+port,dst:ip+port

NAT can change any combination of ip and/or port.

#3 is any entirely different subject: spoofing

#4 "Static NAT", or "1-to-1", is an address only map. So, port (and even protocol: tcp, udp, gre, etc.) is irrelevant.

The router knows where packets belong because The router saves ... an address translation table. It remembers what inside-outside address translations it has made. As such, one inside address equals one outside address, and the out-on-the-internet destination is irrelevant. This, of course, ignores the firewall present in practically every NAT router, which tracks full connections:

(inside) src:ip+port,dst:ip+port <-> (outside) src:ip+port,dst:ip+port

NAT can change any combination of ip and/or port.

#3 is any entirely different subject: spoofing

#4 "Static NAT", or "1-to-1", is an address only map. So, port (and even protocol: tcp, udp, gre, etc.) is irrelevant.