Little hard to speculate in much detail without some traces to look at (TAC can help you turn on what you need here) but right off hand this type of thing sometimes has to do with notification setup.

If an outbound notification to a phone is configured to an internal extension that is then also configured to forward into Unity you can get this - the notification conversation will ask for you to sign in a few times and in the meantime the greeting of the user's mailbox is playing on the other end and then starts recording - Unity is essentially recording itself at that point.

The typical way to prevent this is to make sure you have your port extensions defined - then Unity will notice if the original calling number is one of those extensions it knows to terminate the call right away.

You can search through your system and look for any notification device set to call that user's extension (or perhaps an alternate line that's defined as an additional extension for that user) and trace it backwards - the easiest way to do this is to use Subscriber Information Dump and include "notification devices" in the list of outputs - this will include all phone numbers for all devices configured.

There's other possibilities for Unity getting conferenced into a call like that but this is a common one and worth looking into. Beyond that you'll want to get a TAC case open, turn some traces on and then see what's happening at the time the call was left.