Check all your mailboxes to see if there are any that have the ability for outbound transfer or off prem notification and are NOT already programmed, in other words it is enabled in the COS but the user has not set it up with their own numbers. You'll also want to make sure that the passwords they are using are not the easy obvious ones like 1234 or 1111 or even leaving them the same as their extension number.