Try this script it will tell you not only what the users have permissions on but what user defined roles they may be getting it thru.

http://www.sqlservercentral.com/scripts/contributions/268.asp

It doesn't give system roles but you can get that from one of the SQL built in SPs.