[cisco-voip] Minor investigation help

[Robert]

I have a little mystery to solve...

A user came back to her desk to find her prime line had been forwarded
to voicemail. Obviously, that is very simple to do by pressing CFwdALL
then Messages. The user did not know about that method. She uses her
CCMUser page to forward other lines on her phone. She pulled that up and
verified that it was forwarded there as well, and unforwarded it at that
time. Shortly after that, she called me to see if we can figure out who
forwarded her phone.

I am confident that she did not accidentally forward it herself. My
question is, how could I see who did forward that extension? My thought
is that someone did it from her phone as a prank.

Any suggestions how I might determine at least whether it was done at
her phone or by a CCMUser page?

Thanks,

Robert