We have seen the same behavior with a home users remote phone. We have determined also that the calls are coming in thru the users firewall as described.
When the phone communicates to the outside the cheap firewall is opening 5060 to the outside and allowing any traffic back in rather than limiting the traffic to only from the single destination.