Network engineers often make very arbitrary decisions with regards to IP numbering/renumbering.
RFC 4913 suggests using the current timestamp + the mac address of your machine, sha1 hashed and then taking the lower 40 bits to generate your Unique Local Address (ULA). An RFC that is specific about generating an arbitrary number.
I doubt much thought went into it - it was an unused, unannounced block that didn't conflict with their existing 10.0.0.0/8 network.
If the author wanted to look, the Via header is actually not a great place to look. It's not the most accurate header in terms of telling you where the call is being handled.
If you look inside the SDP's (usually in the INVITE and 200 OK, potentially 183/180 or ACK) it will tell you where the actual RTP traffic is going. If those RTP ports and addresses are changed something is certainly foul. My guess is they are not.
If you see a Record Route header it means some proxy has inserted itself into the signaling traffic. Or again, if the SDP inside SIP header is changed.
RFC 4913 suggests using the current timestamp + the mac address of your machine, sha1 hashed and then taking the lower 40 bits to generate your Unique Local Address (ULA). An RFC that is specific about generating an arbitrary number.
I doubt much thought went into it - it was an unused, unannounced block that didn't conflict with their existing 10.0.0.0/8 network.