If you aren't using VM notification out to cell phones or outside lines, remove the ability of the VM to use LCR. This will at least eliminate one possibility, as the previous poster noted.

It will also prevent hacking the VM to get free long distance calls.