Cisco 303 issue

One of my users has a Cisco 303, it’s worked great for a year but lately it’s started asking for a password to redial or access the contact list. the only way to get it back is to do a factory reset and set it up again.
He noticed today the phone rebooted all by itself then the activated call forwarding and now asking for a password.
We’ve tried any password we have but nothing have worked.
If I’m reading it right we are running Version 11.10.2

I’ve got another user with the same phone that’s never had this issue, anyone have any ideas what might be causing this?

Thanks
Brian

If your phone is exposed to the internet or an insecure LAN environment, perhaps suspect that it is being suborned, It would be interesting to see to what number the extension has been “call forwarded” to.