Ahh sorry for not reading your initial post clearly.
The user most probably used some manipulation of his NIC card to get into the Voice Vlan in the first place, a penetration testing tool commonly used for this is Voip Hopper:
http://voiphopper.sourceforge.net/
Detailed description of the attacks can be found on:
http://www.securityfocus.com/infocus/1892
And on this presentation, that I would highly recommend you should have a look at:
http://www.secureitconf.com/documents/VigilarVoIPHopperSecureITv1-1oSTROMANDkINDERVAG.pdf
The Cisco Solution (should be combined with other security best practices like port-security, etc.)
http://www.cisco.com/en/US/docs/switches/lan/catalyst3560/software/release/12.2_37_se/configuration/guide/swvoip.html#wp1050112
The specific command is:
switchport voice detect cisco-phone
I hope this helps you to take a step in the right direction to secure your VOIP network.
If you enforce this, the user cannot access the voice vlan in the first place, left alone listen to multicast/broadcast voice mails (which I doubt happened in the first place anyway). He most probably used one of the above techniques to capture the 'unicast' VOIP traffic.
Regards
Farrukh
