Engineers worry when their mathematical models do not coincide with reality. Physicists worry when reality does not coincide with their mathematical models. Mathematicians worry when they see others trying to apply their mathematical models to reality. From this I deduce that Superpiper is an engineer!

The leaking ball valve appears to me to be a big clue. Nature always finds the weakest link to attack. I once had the privilege of listening to a great structural engineer explain to a client that there was no point in continuing to replace rivets that had already popped out several times, because, "Mother Nature is telling you she doesn't want you to have rivets there." (Younger engineers reading this should perhaps consider the fact that he already had done plenty of analysis to prove that the overall strength of the joint, minus the absent rivets, still met the design code.)

The trunnion, although overloaded in theory, is likely to be able to bear considerably more load before failure than the ball valve body. And the leaking ball valve is likely being distorted by the loads that CAESAR II thinks are being applied to the trunnion, so that the calculated loads on the trunnion are not a part of reality.

It might be interesting to model the ball valve as flange pair with a short length of pipe with OD and wall comparable to the data presented in table 3 of ASME B16.34 between the flanges. You might find this to be a whole lot more useful model for a valve than simply calling it "rigid," at least for the problem at hand.

As to the recommendation of a site visit, I heartily agree, but I would try to be very, very careful and alert near the trunnion. Most of the time, I would expect the trunnion to simply shear off the pipe. But most of the time drunk drivers manage to get home safely. Our design rules are based to some degree on statistical data, and statistics are only averages massaged by mathematics.

Obviously, as noted by many above, the load type is absolutely critical to any analysis of this problem. Your first reaction seems to be very prudent - get the load off the offending structural element first, then figure out how to replace that structural element with a non-offending one.