They have to check that the state token is minted with the default minting policy.
The default minting policy and SM validator are coupled so that if this is verifiable, then all is well.
A TreadToken is automatically created when the StateMachine is created by the first participant (wallet).
Not necessarily. You can "Start" a SM by sending a UTXO to an address that corresponds to a SM. This is precisely why you might want to verify that the the thread token is an NFT.
If the default minting policy is not used then they'll need to do more homework. Again this might be fine. It might not.
It's possible to replace the default minting policy with a non-parameterized minting policy that shoe horns the uniqueness into the token name only.
In this case it would be much easier for a user to verify uniqueness, provided a trusted source has already verified "This CS will only make NFTs"
(policyId is a synonym for currency symbol)
An aside. It might also be desirable that the thread tokens aren't NFTs.
More generally, there are many ways you might want to modify the implementation of statemachine as available in Plutus. Its just one way to do it.