SSH attacks on the 5000 are pretty common when it is port 22 is forwarded from the outside... Just turn off SSH except when you need it, problem solved.
If it gets real bad, this can bring a 5000 to it's knees and even stop call processing, you shouldn't port forward port 22 to the phone system unless you can setup originating IP restrictions, or like I said before, turn off SSH shell in the system.