Also, change the admin password from null null null null, if you get my drift.

Take off the # for subscriber access if no one uses it. Set up voicemail to email instead.

Delete all unassigned extensions and mailboxes in the VM block table.

We had one where the caller coming from Skype in California accessed admin mode and made an extension, something like 888 or 800, and routed that to an off-shore number.

We eliminated remote user access (#) and deleted all mailboxes and made ports restricted from outbound (no one uses remote notification much anyway) and that more than cleared it.

You can look at your VM logs and actually see them call in and do it. It's interesting.