Theres a few things you need to be checking,
set class of service 30 your unused extensions and voicemail ports.
Turn off pager, message alert and outcall in mclass/eclass on the voicemail.
Set toll deny to block international calls.
Change all passwords from default especially voicemail.
You could check the SMDR output to see if its logged the calls.