Good questions. I've been considering them, myself.
It was not a local costume. I'd purchased it online from Amazon and had it delivered. I assumed it would be safe to wear, otherwise I wouldn't have tried it on in the first place. There was no indication of magic upon the costume when I opened the package - it wasn't until I tried it on that the magic took hold.
Yes, I still possess the costume - I have to safely locked away. Now that it's been worn, I can detect magic emanating from it, but at a low frequency. You may come over to inspect it yourself, if you'd like.
Comparing my costume to the ones from the original shop, I'd say that the magic is spreading, and while the source from which it spreads is very difficult to pinpoint, I think it's safe to say that it comes from somewhere within Spooktacular.
I couldn't tell you whether or not it's being maintained. The man suspected of casting the spell has not been seen in Tumbleweed since the day before the first transformations took place at the party, which may suggest it doesn't need to be maintained, but that does not mean a) He's not hiding somewhere in Tumbleweed, b) he's maintaining it from a distance, or c) somebody else is maintaining it. I can tell you, there's no sign of it diminishing.