The '&' is used to refer to substitution variables in SQLPlus. These variables can be set using the DEFINE keyword. Alternatively, if not specified using this keyword, SQLPlus will prompt you for the value of the variable and continue prompting you every time it sees &variable
The double '&' tells SQLPlus to reuse the first defined value of the variable. For example, if you were prompted for the value of usr based on your connect code snippet, all subsequent occurrences of &&usr would be replaced with this value. In this case SQLPlus will prompt you only once to enter in the value of usr.
EDIT:
Yes you can pass in parameters from a shell script. Example:
$ cat a.sh
#!/bin/bash
# Ideally, you would retrieve the password from a secure
# location like a password safe/vault etc. Never hardcode
# the connection credentials
USER=scott
PASS=tiger
INST=orcl
sqlplus -s /nolog << EOF >> some_log_file.log
connect ${USER}/${PASS}@${INST}
set serveroutput on
select user from dual;
EOF
$ ./a.sh
$ cat some_log_file.log
USER
------------------------------
SCOTT
$
&&indicates parameters that are, in this case, used to connect to the database.