That is PAT not NAT. Port numbers are a scarce resource and there are various ways to allocate them. This may be a 1:1 or 1:random or n:n static range or n:n random.

A stateful PAT would inspect packets to set up port translation and these things used to have lots of bugs and no filtering to check if the packet is from internal or external network at times.

You can often still send to the direct target port and IP if you guess or figure out the mapping. Scanning 64k numbers with packets is not that hard.