They get in by mail box with weak, or no password. Then sit up outbound tranfer to a foriegn land on that mail box. Hang up and call the mail box back, then press 7 and out they go.
I've been to 5 sites where they had recieved serveral thousand dollars worth the toll fraud and the FBI was invovled because of 911 aftermath these calls were being directed towards middle eastern nations.