ADDITIONAL INFO #3 Some experimentation has led me to a partial answer. The first thing I was missing was that "Request Throttle Memory" (RTM) does something useful if it is set higher than "Maximum size of post data" (MSOPD). In my first round of tests, with no clue about the relationship between them, I had them the other way around. With my new understanding, I can see that the ratio RTM/MSOPD is the number of simultaneous uploads that will be allowed if they are all near the maximum size.
Assuming that the "Request Throttle Memory" is actually a memory buffer, and not a temporary file, this means that my worst fears were correct. Every file is kept entirely in memory for the full duration of its upload. Nobody has said anything to make me believe otherwise (although I also don't see anyone jumping up to say "yes, they did this stupid thing")
Also with this new understanding, the stalled uploads make some sense. The server doesn't have memory available to accept the upload, so it just doesn't read from the socket. The TCP buffers fill up, window size becomes 0, and the client waits it to open up again, which should happen as soon as the server starts reading the request. But in my case, for some reason, that never happens. The server forgets about the request entirely so it just lingers.
The case of "Maximum size of post data" being hit is still a bit of a mystery. Requests that hit a hard limit shouldn't be queued, just rejected. And I do get a rejection message ("Post Size exceeds the maximum limit 200 MB.") in server.log. But again in this case the server seems to forget about the request without ever sending an error to the client.