Marketo only dedupes against email address when the lead is imported directly into Marketo OR into a Marketo Form.
When it attempts to dedupe against existing Leads or Contacts, it chooses the most recently updated record if all the emails match.
Empty fields are filled in.
Non Empty Fields WILL GET REPLACED, unless you have Field Blocking on.
Marketo will not "merge" an existing SFDC Lead with the incoming Marketo lead, rather it sees that it should update the SFDC Lead only.
You can merge SFDC Leads and Contacts and Marketo Leads manually. Scores are ADDED when you do this.