AFAIR they run Vxworks and there's a serial port on the board somewhere you can play with. (I never got around to RE'ing one a while back...)
Its quite possibly the accessory port, as as far as I know its serial. Look for a little 5 pin female header accessible from the back of the phone.
The phone Tx's Serial data on this line to control headsets and the like.
Might be worth me trying to look at those ports at some stage..