I thought I had disabled UPNP on the router - but I hadn't. Disabling UPNP on the router prevents the pass through happening. But I'm still not sure that's an appropriate design. While my cameras are password protected - they were weak passwords as I "assumed" my router would not be forwarding any traffic to them as I don't have any port forwarding, firewall rules, virtual server rules enabled. Also remote admin does not need to be enabled for this event to occur. ie you can have remote admin disabled, but with UPNP enabled, and UPNP on your internal cams then the router will pass traffic through. I don't know that enabling UPNP as the default on the router by Dlink should be the default setting given this.
As to previous questions on cameras - all are Dlink. A few 7010ls, a 5222l, and a 936l