Try to explain the difference between Authentication Username and (ordinary) Username. Think it needs an example ro make it clearer...
Also some equipment may support the disabling of calls being sent direct from the Internet. For example, Grandstream firmware often has a feature ''Allow Incoming SIP Messages from SIP Proxy Only'', which is worth using (unless you need to accept such calls).
Your equipment may also support a feature whereby incoming INVITE messages are only accepted if they use the User ID which you used when registering with the SIP server, maybe named ''Check SIP User ID for incoming INVITE''. The SIP server will know this User ID, random SIP spammers will not.
[[File:aa-button.png|link=http://aa.net.uk/telecoms.html|Telecoms page on our main website]]