look in system staus and check the ars form being used in the active calls tab.
In Monitor, use Ars, error, short code, print and possibly line filters to watch the attempted number being dialled.
I predict your system has a trunk access code and it is not being used when dialling the directory number. You might need a short code that inserts the trunk access code at either the system or user level.
It could also be that they're trying to transfer to the directory number and trunk to trunk transfer hasn't been allowed in system/ telephony and against the analogue line.
Depending on the URI configuration the ICR can be completely ignored.
If your URI is configured to use internal data then the IP Office will look into the user's SIP tab and if you have *'s it will look into ICR.
A madman with a taste for speed.