Preventing bogus SIP invites.

[Glacier]

Hello

Periodically some of our T38 IP phones receives ghost calls, due to getting SIP invites from an external source, other than our VOIP provider.
I have read the posts explaning how to configure the phones, to ignore these invites. However what i couldn't figure out was, how to the phones receive these invites in the first place?
Our firewall should block all outside-trafic trying to get in, and there isn't configured any portforwarding etc. to accommodate the VOIP trafic. So im a little lost on how the attackers manage to get SIP invites through the firewall and into the specific phones.

I could just configure the phones to igonore the direct ip calls, but i would rather stop it at the firewall-level.

Do we have a impropper configured firewall?

I hope anyone can shed som light on my issue.

Best regards
Esben