My guess is that this is actually what happened here: Some carrier or VoIP software leaking its DNS queries to the public internet because the service is using

My guess is that this is actually what happened here: Some carrier or VoIP software leaking its DNS queries to the public internet because the service is using is only set up to respond for e.g. NANP (+1) number ranges and the rest is falling through to the public (and largely unused) ENUM.