Update: well, it took just over three hours, not 15 minutes, but we’ve stabilized again and are back in service.

The root cause was a conflux of several problems (a configuration setting, some ill-advisadly permissible user-entered text, and a failure to filter stuff out) that  have been or will all be fixed.