There is a PRI coming in -it is supplied via SIP, then converted to PRI with an adtran box.  Do you think that the ghost calls are actually from outside?  When the user gets a voicemail from the ghost calls, they appear to have come from the other extensions, but possibly they are coming from outside instead?  I have not looked at the SMDR yet,since I thought that the calls were coming from inside.
Thanks!
Trenton