Strangely, today my callthrough inbound route started to ask for PIN I used in the past, not accepting the current PIN anymore. I went into settings and canceled callthrough, and set to send everything from this route to VM. I committed the update, verified that I have no route with callthrough - and yet my call answered with callthrough, demanding old PIN.
Looks like something was restored from backup, and it doesn't accept new updates...