All of the reports I have seen indicate that they exploit sub-accounts, and only those for which international calling is enabled: possibly only when enabled for the UK, as mine was.

When they hit an account, it is very abrupt, usually overnight Saturday to Sunday. They hit it hard and continuously (with calls) until Voip.ms belatedly disables the account with a negative balance in the hundreds of dollars.

Mine got re-enabled yesterday, with the fraudulent charges all reverted. So, good.

Cheers