Is it possible someone is sending them calls using TRANSFER TO HOLD? That sends the call without ringing, usually used when you want to "park" the call at an extension for longer than a regular transfer, which does ring but then goes to vmail (or wherever SYS FWD sends it). Typically folks use TRANSFER TO HOLD and then page the user to alert them they have a call.
It's even possible users may have a TRANSFER TO HOLD button and not understand it.