Find all instances where a user has been explicitly granted permissions on an object
Check the sys.database_permissions DMV, which contains all granted and denied permissions.

The major_id will point to the object_id in sys.objects, the minor_id points to the column_id in sys.columns (if applicable).

The grantee_principal_id and grantor_principal_id columns point to the granted and granting user ID respectively, which you can find in sys.database_principals.

Remember that permissions can be assigned not just to users, but also to server or database roles, which the user can inherit. Also, granted and denied permissions can conflict, in which case the more restrictive of the two rules applies.

I wrote a blog series a while back, which goes into more details on permissions.