When I had SIP enabled and standard ports forwarded, many days I saw almost continuous attempts to register several thousand extensions at a time.

As I said in my previous post,....

I cleaned my house and slapped myself on the wrists, after having completely lost access to the repeater.

Login for root was enabled, and after a couple years, they brute forced their way in guessing the password.

While the password wasn't "1234", it was in the dictionary.

In many cases it doesn't mean going crazy, just examining your set up and correcting dumb stuff.