Still not entirely clear on what is happening. An extension is having voice mails left after hours triggering the message waiting indicator?
If you use two digits on the PBX, then 99 is the default mailbox access number.
If you are actually receiving "mystery" calls, then have a look through the 3CX Activity Log for calls to the extension in question. If the call has passed through the PBX, that log will show why it went where.