Check the port activity when line 2 goes into the vm. This will show the call routing, you can then collage it to the other lines.

You can either did this in real time via telnet, or look at the logs after the fact via the web interface (due to the age unless you've upgraded to 4.4x sw I wouldn't use dm)

You can override the vm schedule which may have been done via accident (can't remember the mmc for this).