I completely fail to understand why they have IP phones internally.

I'd replace them with TDM sets and dump the IP phones on eBay.

I'm also with Coral Tech and others, there's probably a hole through the router and the system is being attacked. We've come across this identical scenario where some slick salesman tells the customer they're getting a high tech VOIP system when the reality is something different. It doesn't take too many service hours to equal the cost of switching the phones out.