I would still be looking at the system, i wouldn't think that many of your customers sip accounts got hacked especially when samsung acknowledged a problem with peering being vulnerable. Who knows to what extent people can exploit it and you know how persistent these people can be.
nameless i was told even if your using the alive notify to still do a DENY ALL on 5060 and then allow your carriers IP's. It is a pain in *** especially if they tend to change IP's once in a while but it did stop all of our problems.