How to ensure a factory reset wipes /data/media?
/data/media is actually your so-called "internal SD card" space.  It's not wiped by default because, as the name implies, it's intended for media storage like photos and music.  It usually should not contain any personal account information or important app data (that isn't encrypted).  Many custom recoveries do have an option to wipe the internal SD card, you just need to select it when doing your factory reset.

TWRP actually has a detailed post about this at https://twrp.me/faq/datamedia.html.  The most relevant excerpt:


  In TWRP we also have a wipe internal storage option that rm -rf's the media folder and a "Format Data" option that formats to recreate the entire file system in case something goes completely wrong or to remove device encryption.


If you just want to free up the space, you could also simply use a file browser to deleted everything on your internal SD card.