Just in case you're still curious about how this was occuring. Check the follow me numbers in voice mailboxes. Seems like it would be really easy for somebody to guess a default password to a vm box. Setup the follow me to be an int'l number and then all they have to do is dial the 800 number, dial the mbox and then the follow me does the work. Doesn't your inbound 800 have CID? Tapit should tell you where the call originated if there's any valid CID getting through. People seem to have covered all the other possibilities, but this one was left out so I had to mention it. Also, if they experiment some, the fact that you busied out the pots line won't stop them. All they would have to do is change the 809 to something else in the follow me. Hmmm, now that I think about it, I don't remember if you can direct access a trunk from a follow me in an imagen... Somebody with a testbench could tell you. Good luck busting whoever did this.
