Change Auditor calculates the number of mail-enabled users by query each domain in the forest with the following LDAP query:
Mail Enabled User Count Query
(for Exchange licensing including Office 365 Exchange Online):
(&(samAccountType=805306368)(|(&(!userAccountControl:1.2.840.113556.1.4.803:=2)(msExchHomeServerNam
e=*))(&(userAccountControl:1.2.840.113556.1.4.803:=2)(msExchMasterAccountSid=*))))
