Note that typically, on Dahua gear, Illegal Login in the log means they "tried and failed", and based on the number of attempts set on the device, were blocked for some time duration (also a setting)
Willing to bet you are still port forwarding or UPnP is enabled @alastairstevenson mentioned...