Who uses Dual_EC_DRBG?
Here is a list of products and companies who have had their EC DRBG algorithm validated by NIST.
http://csrc.nist.gov/groups/STM/cavp/documents/drbg/drbgval.html

The validation lists all modes that have been validated, so you can see which ones have gone to the effort of having their implementation of Dual_EC_DRBG validated.  Tim Dierks points out that, for Lancope's certification (NIST validation #288), Dual_EC_DRBG is the only listed mode of operation that was tested or validated.  It's hard to know why Lancope would have submitted their library for validation if they weren't using it.  So, it sounds like there exists at least one implementation in the wild that uses Dual_EC_DRBG.  (Thanks to Tim Dierks for this analysis.)