Okay, stupid question (as I said, I’m just a hobbyist and don’t know a lot about this): it doesn’t matter which port I use for incoming as long as I use 5060 outbound to connect to my employer’s PBX? And, if so, I’m pretty sure that the phone I’m using (Grandstream) only allows setting a single port. I’m confused.
For what it’s worth, the reason I got this call at 4:20 am is that someone actually dialed my number.
Your Grandstream allows (actually requires) a port and host for each registration (line).
So one against your employer (5060 and his URI) and as many as you are allowed against your PBX or other service using anything but 5000-5099, always prefer TLS or TCP (WS, WSS if relevant) over UDP
I surmise your DID possibly ‘escaped’ previously through your SIP hardware being compromised, I am intrigued . . .