I have a customer who was locked out all their VM boxes the system admin password was also changed. last week i went on site. I used the back door password to gain access reset every ones MB passwords all was good. Today I get a call saying its happened again. Also, the customer got a call from an individual at home who said they got a call from someone claiming to be master card but the caller id name didn't match. (The individual called them back by looking up the company name from their caller ID)
I'm thinking someone has hacked their voicemail and is using it to make calls on their lines. I guess the way to stop this is to restrict CO line access to the voicemail ports But that wont keep the hackers from messing up the VM Is their a setting in the PVM (full sized card) to turn off the ability for remote log in?

First, with access to the Voicemail, you can't make outgoing calls. You CAN change the outcalling number that alerts a user that they have a new message to listen to. You can restrict the VM ports to No Access to the outside lines in #302 (won't affect them VM ports being able to answer incoming calls)

Second, ACS R6+ has Remote Call Forward, but they can't change the settings on an extension without using the Remote Programming GUI, and they won't be able to turn an extension's forwarding on or off remotely.

Third, the spoofed call from Master Card is totally unrelated, some scam caller randomly used your customer's telephone number for the call to appear to be calling locally and hoping for a better chance of being answered. Nothing anyone can do about it.

Fourth, in the title you say Partner Messaging, but in your post you say PVM full sized card. Which is it? The backdoor for the PCMCIA card Partner Voice Messaging can only be used on site, while the backdoor for Partner Messaging module can be used remotely. Luckily, the password is much more complex and not well known.