Yes, you have to upload the files to Twitter. You can include a URL, but it will just be a URL, not a media file on Twitter or in the Direct Message.
You don’t have to check the status of the upload, but we highly recommend it, as it reduces the chances of errors when attaching the media to a Tweet or Direct Message.
If a user has already sent you a Direct Message, then you would already have the recipient ID. Yes, you need the recipient ID to send a message.
As announced this week, from September 10, all applications will have a POST limit enforced which would reduce this to 1000 Direct Messages per day in total across all users. If you need more than this, you’ll need to apply for an elevation once you’ve applied for your new developer account. Note that adaptive rate limits also apply to Direct Messages.