Great response and well detailed!
You know the root cause: someone set the AI in-duct reading to 70°F such that the heater went full bore to maintain 73°F when the real value was actually masked.
Full electrical heat in a non-flowing air duct means trouble, unless safeties suit the application. A high temperature limit kill switch might be necessary (separate from the in-duct temperature sensor), set for about 130°F near the heater, below the temperature of the FD fusible link.
The proving switch that enables the heater to operate could also look at an airflow value versus a pressure value. There can be plenty of static in a dead duct while having a no-flow condition enabling this to happen.
As far as forensics after the fact… I had a dryer with an electrical element that fried; turned out it was a drum bearing failure causing unusual contact points resulting in short circuits. It’s difficult to tell what happened exactly after an electrical failure, much like trying to diagnose a lightning strike. For now, consider instead the safety elements that prevent the failure in the first place.
One thing: “The heater wires have no gray color anywhere so we have never been starved of air” and “without going into details about the various integral duct heater safeties and the external safeties I programmed into the BAS on top of those safeties to ensure there is no overheating of the ductwork” could hold some answers. There’s complexity built into these statements and one small detail could hold the key…