Thousands of login request in few days - hackers?

It seems someone wrote an application to generate many thousands of authentication request from authentication service we created. They used some phone numbers to verify account that seems temporary (acquired from voip service). This seems a little wired. Why someone would do that? He managed to make the system spend some small amount for making the calls but that is probably what they spent to receive the phone calls.