got my answer.
@mirror_web3 explains it:
noxa had already disabled launches. bots kept hammering launchToken with fixed ETH amounts anyway. those calls reverted, but the attempts and their msg.value still show up in the history.
so the 4,879 ETH is summed failed calls, not money the factory received. the fixed 0.4505 / 1.0005 chunks were bots repeating a dead call, which is exactly why the cadence looked machine-like.
i was wrong on the scale. no $9m went in.
leaving the post up. this is what asking instead of accusing is for.