Hi Andy,
Starting with Q7 - this is the current limiting transistor. Any output current develops some voltage across R1. eventually this voltage will be high enough so that the Vbe on Q7 makes it turn on. The current through Q7 will pull the gate of M1 (blame LTSpice!) toward ground, hopefully reducing the load current.
It's difficult to follow the effect of R4/R5 in my head, so some simplification is in order ...
Imagine shorting the output. The emitter of Q7 in now clamped to GND. The load current into the short will develop some voltage on R1 and most of that voltage ( actually 180K/(180K+3K) or 98% ) will appear as Vbe on Q7. At somewhere around 14mA into R1 Q7 will be conducting strongly dragging the gate voltage down. So, into a short circuit the current will be limited at this level.
At higher output voltages the current limit will also be higher, this is the REAL purpose R4/R5 (so called fold-back) ...
Now let the output be at 300V and work out the current limit. The emitter of Q7 is at 300V. To limit the current Q7's base needs to get to ~300.7V. Now workout the voltage needed at the junction of R1/R5, this is 300.7*(180K+3K)/180K=305.7V. So one end or R1 is at 300V and the other 305.7V which occurs ~ 83mA
At you say, D4 is protection. For little or no load current, at a high output voltage, R4/R5 can reverse bias BE junction of Q7, this is very destructive so I popped in a diode. I only spotted this via the simulation
dc