Really odd... but sounds like a forwarding issue (not sure about the console calls though... do they normally use call forwarding? If not, and they have a console you could cancel all call fowarding and see if the problem continues.
On another note, what kind of VM are they using, embedded? There could be a notification set on a mailbox.
Have you changed any FACs lately?