Interesting questions about WS-Addressing. Here's my take:

WS-Addressing can enable callback. However, <ReplyTo> isn't required. In my world, <From> is typically the node who sent the message. When you decide to reply ("callback") to the message, you should send it to the location specified in the <From> unless there is a <ReplyTo>, in which case the <From> is essentially overridden. If you need send a SOAP fault in response to the message, you can send it to the <From>, unless there's a <ReplyTo>, but if there's a <FaultTo> you should send it there instead.