We have a customer ( 7200S V 4.53C ) with POTS lines, that is getting inbound calls from a CID source labeled 1100
These calls ring in to SG 500 call buttons, not DT buttons.
It's not someone hacking the system, since there's no outside source of the calls.

We've used SMDR to track the calls and they have no source. They're not IC calls and no trunk displays.

I've used port status to watch the calls as they were ringing. While the call was ringing, port status showed nothing ringing to the 3 phones in the 500 group.

I'm up against a brick wall in terms of finding the problem.
My tech support guy ( at distrib ) is still scratching his head.

Any thoughts would be appreciated.

What kind of phones? I actually see this a lot with legacy DCS phones version 1.1 or lower on an Officeserv.
Edit*
If they are not DCS phones make sure the phones you have register to what they actually are in 6.2.1. There's was a certain repair center that liked to refurb iDCS phones and put the wrong chips in them. 28's would register as 18's and vice versa causing them to do strange things.

They're all iDCS 28 and they're registered as such.
How did the old DCS phones manifest this ???

i emailed you