Thanks, y'all. We're battling an absolutely huge and overgrown production database that can't fit on any of our development machines right now. The culprit is that long ago "Store attachments in database" got checked and now years later we have gobs of files in there and it's of course hideously inefficient to store binary blobs in relational databases.
To battle it, I've built a "Kentico Spring Cleaning" module. One of the things it does is moves attachment binaries out of the db and into the file system. But I'm also playing with a system that can truncate attachment histories on attachments that haven't been touched in long time.
The repo for that module is here. It's built for Kentico 8.2 right now (we're furiously trying to upgrade, but testing is, um, hard when you can't fit the database into any of your developer machines).
Anyway, the feature I'm working on right now is to safely clear out old unneeded attachment histories. The idea is you can select attachments that haven't been touched in the last X days and remove all but the newest N attachment histories (but NEVER delete the last one, made that mistake already). Not exactly related to my question above, but it's how I came across the "orphan" attachment histories.