Do you mean that callers to these extensions go straight to VM without ringing the phones first, or are the phones getting set to call-forward-all to VM 'by themselves'?

Option one could mean that the phones are losing connection across the MPLS and callers to this remote site are transferred directly to VM, since CCM sees the phone as unreg'd.

Option two could mean that users are inadvertently hitting CFwdAll before hitting their messages button.

Or, you could have a database replication issue if you have more than one CM.

Another thing I've seen is a malicious user logging into CCM user pages for fun and setting the CFA through the web. Most people set up their systems with a generic password for users. (I would recommend AD integration where possible.)