And Since you probably have a "uPNP" router that auto sends stuff to your VOIP phone... since one of my employees has one and can;t figure out to only allow connection from our VOIP provider and never direct connections...

It is tough.

Trust me, all it take is a person with a rouge Asterisk install and a couple of "land lines" or equivalent... and an internet connection... and voila they can do all kinds of social engineering.

No, you phone wasn't hijacked before you did you did your calling out.

Next time it happens, because it will. If you answer the phone and then hang up, you really didn't hang up, unplug power from the phone. Or use your cell phone to do the checking and or call the phone with your cell. If you establish another connection or break the existing connection... it resets.

They could have gotten you to local forward a very expensive call for you. This is one of those things were I hate these "phone services" provided by AT&T and Comcast and other non-phone carrier service phone services.

Needless to say, get a new phone from AT&T or have them update the firmware on the phone to restrict inbound direct calling. (More than likely they'll have to send you a new one... especially if you have one of notoriously really cheap phones they use.