Hi,

"Ghost calls" usually may happen in for several reasons. One of them is that you left port 5060 opened in your firewall or router to your PBX. There are different scanners, probably malicious, running on internet looking for security flaws.
Other reason may be is that you have IP phones. You have to restrict accept IP´s in IP Phones settings to receive calls only from your SIP provider IP.

Regards,
Tomas