Hello Ppimadmin,
You are correct.
Generally Exchange servers are added to the ESA in the.
GUI > Network > smtproutes (to ensure inbound emails are routed directly to exchange instead of falling into DNS lookup and looping)
GUI > Mail Policies > HAT overview
Ensure you're looking at the right listener, go into the RELAYLIST and remove the exchange servers who should be no longer connecting to the ESA to relay outbound messages.
These are the two general areas.
If you believe the admin may have created some custom rules outside of these two general areas where exchange IP would exist, my only recommendation would be to save the configuration file to your PC, and find the IP of the exchange to see if it exists elsewhere within the configuration then trace it in the GUI to remove.
Hope this helps.
Matthew