Are you sure they don't know how to? Because this looks like they might know.
Log in/out can be done also using dial codes from IP Phones (default codes are *62 / *63).
Maybe change the dial codes from Settings --> Dial Codes and see if this still happens?
Don't forget that log in/out can also happen through Mobile apps, WebClient, Windows client, so if the users have any of these for any reason, they could also be using those.
Could it also be that the IP Phones they have were unregistered?