How i was hacked?

Sorry for my english.

I noticed yesterday many calls:

112707 2011-01-06 23:05:56 "101" <101> 101 16015443560 from-internal SIP/101-b6966b08 112706 2011-01-06 23:05:54 "101" <101> 101 16014821687 from-internal SIP/101-b71b39c0 112705 2011-01-06 23:05:52 "101" <101> 101 16015448078 from-internal SIP/101-b7486220

Extension 101 is under the password. I used asterisk -rx ‘sip show peers’

Then I changed the password and the calls stopped till now. Then I found in logs many entries like this:

My question is not how he hacked me, but how he was making outgoing calls?

Because extension 101 is allowed to make them.

viewtopic.php?f=1&t=76654