Are you paying for SMS pumping?
Eight questions, about two minutes, and you get the answer whether or not you ever talk to us. The method is the one we'd use on your logs: legitimate one-time-passcode traffic converts at 70–95%, pumped traffic converts at near zero. The gap is the bill.