Sorry for coming on a bit strong, I really do just want to help. Thanks for the reply. Your answers reveal quite a bit, actually.
If you don't mind, I'd like to do an experiment in the vain of Bill88's suggestion. I'd like you to call line 1 two or three times in a row, but hang up before the call is answered. Let it go on the third or fourth call and see if you hear modem/fax tone.
These alarm systems are designed to share dialtone with voice lines. And the way remote techs "signal" the unit that IT needs to answer is by way of this repeated "ring/hang-up, ring/hang-up, ring...ok now answer" trick. It also explains why the problem may appear intermittently (during rapid or high call volume periods, for example).
I believe you when you say that you don't have an alarm system or that one doesn't appear to be tied anywhere on your backboard. But hundreds of demarc pairs are very often shared along entire city blocks, and there's no law that says some dope up the street doesn't have an appearance of your dialtone with his alarm system tied to it. If you don't believe me, run up and down YOUR demarc with a test set and see if you don't find a couple of dialtones that DO NOT belong to you.
Which actually makes me think of a better experiment. Why don't you do the same thing I suggested before, but do it after hours. Pull the dialtone out of your PBX and repeatedly call the number. If there's any consistency to this problem, you'll hopefully hear the fax/modem tone. If this occurs, then there's absolutely no question that someone else has accidentally tapped your line.