I think I've solved the mystery: g_weapon.c lines 1166-1167:
damage = ceil( ( (float)msec / LEVEL2_AREAZAP_TIME ) *
LEVEL2_AREAZAP_DMG * damageFraction );
Quake3 engine runs this piece of code 20 times a second. Each time, damage dealt to the first zap target should be equal to 4. Notice that the damage franction is ceiled, not rounded. If the server has a few more players moving, shooting etc. all at the same time, it's guaranteed msec will NOT be less than or equal to 50 (1000 / 20 = 50). It'll be always slightly more so the damage fraction will ceil to 5 and bang, here comes 20 extra damage. And it also explains why this won't trigger on a two-player server. It's not loaded enough.