Not familiar with Exchange but can you check the logs?
I assume that this is for your local corporate environment.
Alternatively, you can setup a man-in-the-middle attack (say using proxsmtp or similar) to listen on the non-SSL ports and forward those connections onto the main server. You can log the users IP/login and use that information to find out who is not using SSL.
Alternatively, you can setup a sniffer (using wireshark or similar) just before the mail server to capture the packets and inspect it to see who is connecting via these protocols.
Alternatively, depending on the size of your organisation, how about just asking people how they are checking mail? Via outlook client or webmail application, etc.
Just some random thoughts.