I'm also curious about this. I set my items up as sprites though, and they go in itemslots, which are also sprites. I'm a little wary of this setup, as I'm not sure what kind of problems I might run into down the road. I admit its a little odd to keep them as physical objects instead of abstractions.
Anyway I can see a multiplayer scenario where the host has dozens of ItemSlots, all associated with different players, invisible and not synced with each client. The "paperdoll" sprites, as well as any attacks etc., will of course be synced to each client.
It seems like only your Option 2 is really secure? It seems like using a player's own data in a multiplayer scenario is likely to be subject to manipulation of some kind.