[Freeswitch-users] SIP attack SPA2102

Hi, last night we noticed SIP attack from one of our costumar. Interesting thing is that the call come from Linksys SPA2012 which was behind NAT. The port forward was made for web access(xxx.xxx.xxx.xxx:8099). How it is possible do call from SPA2012 (relay calls)? I am looking at SPA but do not see any of that options. How SIP traffic could be send to SPA from which calls was send as there was no SIP port fwd on router? The device from which calls was send is SPA2012. THank you very much for all explenation!!! Miha