Since there is no sign of a call originating in the PBX, i have to assume that the name display on the set is because that extension number is listed in the phones internal directory against Ext 101.
Given that you had no issues, I suspect that it probably direct SIP calls to the set, and not a set malfunction. These calls would have to be directed to the public IP and port of the line(s), assuming it is behind a router. Have you tried changing the ports of the extensions to something a bit less obvious, like, perhaps 5070, and up. If someone, or something were sending a call to the most common ports, like 5060, 5061, etc. It might stop. I have to assume that there is nothing else on the same network that would possibly be doing this, right?
You could also set-up something like Wire Shark to try to capture the incoming call information that might show where the calls originate. Some ATA's like the SPA-2102,and perhaps even the sets you are using, have a Syslog function, where all information can be directed to a PC on the net running a Syslog server. If you set-up an ATA, or another set, with the same credentials, you might capture something. have you, in fact, tried using another device with the same settings?
You could also try changing the extension number, temporarily, as a test
