The article may be using the term 'machine' differently than what the HN community is used to.

In the Army we used similar technologies for planning, and the technologies were kept on SECRET computers that could only connect to the SIPRNET (an intranet for secret material). Because of the nature of the work we used to wipe and reimage the HDD's frequently (in training environments it was wiped and reimaged after each training session). I image each of those wipes/reimages might count against the 558k count of infringements.

That would depend on the licensing then. While many products do (still) get licensed and tied to specific machines, it's typically considered that if you have X licenses it means X simultaneous installs or X simultaneous active users (that is, I can have it on two machines that I primarily use, but I'm only using one at a time so a single license may be ok, again depending on terms).

If there were merely 558k non-simultaneous installs, this would be much easier to resolve.

Does this mean, that a single machine potentially amassed 2000 installs per year (1 per hour)?

Still, 558k installs/2k installs p.a./38 licenses are still over 7 years. Something doesn't quit add up here.

The article is very non-specific. They may have distributed a runtime on a base image or the full application after the product went through a security review.

I had a case a long time ago where the sales organization for a company agreed, in writing, that they would meter usage based on sign-ins on the server, not installs. Long story short, the sales teams get laid off and the attorneys move in and want to be paid for each install. They lost and lost a bunch of recurring and future revenue as well, as we scoured our substantial install base and read a statement prepared by counsel to the 5 reference calls that resellers sent our way. :)