For years and years and years the private dicks have employed people who work in the call centres at vodafone, o2 et al. This gave them access to a list of numbers that called you or you called - and if on the same network, the name and address of these correspondents. So you speak to the dowler family and get their mobile, check out their favourite numbers. Bingo.
At least two of the major networks used to store the pin code for your voicemail in free text as well - don't know if they've remedied that yet.
And by giving people a default pincode, ie 0000 or last 4 digits of your phone number, and when most people access their voicemail direct from their mobile, bypassing the pin code - a lot of people are unaware it is still set at it's default.
The mobile companies have been criminally negligent in the protection of people's data and should be hammered by the information commissioner. But that doesn't let rupert off the hook - news corps crimes go way past negligence.