Hi There,
I often come across this too and the only solution is to use something which is application aware. You would need to use something which looks at network packets (deep packet inspection) rather than flows. By looking at the content it can be possible to identify what applications are in use.
SolarWinds have recently included application recognition in NPM 11 but I don't know enough about it to say if it can report on Exchange. I'm sure someone will be along here to clarify this. Another option is to use something like LANGuardian which also does deep packet inspection and can report on Microsoft Exchange use.
Hope this helps,
Darragh