Device receiving strange calls

Make sure that call is coming from MOR at all. If phone has more then one line, maybe it comes from somewhere else.

If call came from MOR, you can find it in /var/log/asterisk/full file:

make sure "full" log is enabled.

In /etc/asterisk/logger.conf should be line like

...
full => notice, warning, error, verbose
...

And Asterisk should be restarted after this change on file.

Then local calls will be registered to "full" log.

To find exact call:

# grep "SIP/705," /var/log/asterisk/full
[2015-02-05 12:30:51] VERBOSE[7220] pbx_realtime.c:     -- Executing [705@mor_local:11] Dial("SIP/542-00102d9f", "SIP/705,60,il")

in this example 705 is username (not extension) of a Device which received call; 542 is username (not extension) of a Device which send the call.

And you if can see it like that, you can go and ask owner 542 why he is call (if he not suppose to be).

Alternative solution is to change Username and Extension of Device to something else.