I've written about it elsewhere in this thread but I've found that a simple vopice menu that has a message (that might sound like a voicemail to a spammer's dial computer) and that requires people dialing in to press one key stops 99% of spammers

Other way around, there are bots testing if they can use your systems for placing spam calls.

Yep, if I set 'Allow Incoming SIP Messages from SIP Proxy Only' to 'no' (allows direct SIP-SIP calls) on my home VoIP service, I'll get a silent call from '500' about every minute or so.

I run a public SIP server, and it gets constantly attacked just like any other public service. Mostly trying to use it to call expensive routes hoping it's unsecured though, not trying to spam local extensions.