I've been gone for a bit at a conference, and just got back to find some Emails reflecting the issues here. It took under 30 seconds (28 seconds attributed to dial-up time) of testing to figure out how this happened. Without making things worse by getting specific about how to show what, if you change your designator or extension where you don't want it exposed, you can preclude some of the really easy stuff. Also, all "error messages" should not reflect the nature of whether you have a "live one" or not.
If you want help with ideas on how to block some of this, even with JIVE, I'd be happy to help, as I'm sure James would also.
BTW, if you have the Mod-alert system tied into the functional equivalent of a 403/404, which it shouldn't be, that might explain "flooding."