This is how you do it:
!
voice user-profile 15
user marcos password cisco
number 100,200 type normal
!
ephone-dn 18 << Only used for EM users
number 200
allow watch
!
ephone 1
button 1m18 << Receptionist's Phone
!
What the above means is that you can monitor a real ephone-dn, which has the same number as the secondary line of an EM voice profile. Let me know if this works.
Marcos