When you registered for a 900-number, you had to submit a script along with it. MCI would try to limit the possibility that you'd use it for some nefarious purpose, all CYA. They had a team (probably one person) that audited the numbers periodically. That didn't stop people re-using the numbers for bogus financial services and adult things.
The real kicker is we once got a massive nastygram from Verizon threatening us with shutdown - they claimed we were sending porn spam messages via the number. After quite some time auditing our entire stack we got a "our bad, one of our techs had malware on their Android phone" email.