some NATed clients change their external source port every now and then (e.g. due to a NAT-router reset). They still keep their Call-Id in the SUBSCRIBE, keeping the subscribe dialog open. In this case, the Contact field is not updated and subsequent NOTIFYs will get sent to the old contact (wrong port).
Attached is a patch to update the contact field whenever a new subscribe is processed.