I thought there should be another call leg, and I just went through the logs throughly a second time, but didn't find it.
I looked at a call history log through the gui just now, and when extension 104 calls extension 100, I see what I'm pretty confidant are 3 different enteries all for the same call.
the first one shows the extension 104 calling the user's cell phone, but that's not what extension 104 actually dialed.
I also see a call from the external DID to extension 100 that started 1 sec later, shown as owned by the owner of extension 100, and a call from and to the DID owned by the owner of ext 100, and finally, a call from the DID to the users' cell phone.
I'm not sure how a phone set to forward would come up looking in the logs...this seems odd to me. Its especially odd to me that nowhere in the call history log does it show a call from 104 to 100, but that was what was dialed.