1) it seems that many times the "timeout" value is ignored and instead the balloon disappears very quickly (2-3 seconds). not sure why?
Yes, I also noticed that the timeout is influenced by the timeout of the connection ... but sometimes not.

Try wide values: 100 by e.g
2) I tried to insert a "[" using quoting method ... {:[:} but it is printed literally instead. how to insert a bracket?
[ should work, this depends on where you place it ... give an exemlple of what you want to do.
3) is there any way to get the ip address of the person who connected as a variable? something like %ip% or %ip-address% (i tried those and they dont work)
%ip% should work.
example %ip% & [ ]:
[+download completed]
{.notify|%user%@
%ip% has downloaded:
- %item-name%
from:
{.filepath|%item-resource%.}
|title=%time%
[HFS
] - DOWNLOAD|type=info|timeout=10.}