With reference to replies #22 to #26, concerning UserAgentPorts, I think there has been a misunderstanding.
I do agree with Taoman that you should change these away from the defaults. However, 5060 and 12060 are the PhonePower servers' "SIP listening ports". These values can be set here:
Service Providers -> ITSP Profile X -> SIP -> ProxyServerPort : 12060
This will have no effect on scanners looking for a way in to your OBi.
The UserAgentPort is the "SIP listening port" for each individual OBi spX. They should all be different. Set them at random numbers above 32000. Each OBi spX will send a REGISTER message to the PhonePower servers telling them where to send calls to ipaddress/port – the port will be whatever you have set in the UserAgentPort. This is a sensible change for all OBi owners as one more measure to defeat SIP scanners.
I don't use PhonePower, but I note that on their website there is advice on changing the SIP port of their softphone:
QuoteClick on the check box Open random port above 32000 to allow the entry field to be modified and type in the requested SIP port.
Up to now you have only used default UserAgentPort settings and the advertised 12060, so scanners will be having an easy job getting in to your OBI. Using random ports above 32000 will make it much harder. Of course, if the problem is an "inside job" as Steve describes, then it will not help, but it is a good safety measure in any case.
Good luck with solving your problem.