The kind of information you are looking for is usually found in the message headers. These can be found by opening the message and checking the options for the message. Saving the message as a text file should also include the headers.
Your Exchange server likely is an SMTP server as well, but may have restrictive policies. The SMTP server will be listening on port 25. The submission port (587) is also used, but normally requires authentication.
The normal method of finding the SMTP server(s) is to look for the DNS MX record for the domain. (This should handle incoming messages from the Internet.) There may be additional mail servers connected to the Internet that handle outgoing messages. The internal network often has servers like the Exchange server which may be connected to the Internet.
If you can't ask the appropriate corporate authorities, you may be violating corporate policies to determine the infrastructure. Polices regarding scanning the network are common. Not as common, but just as important are polices around the use of email.
Looking for shortcuts often results in problems later. If you need an SMTP server, follow the correct channels. Given that you need help finding the server, I would expect you should get help in configuring the clients that will be dealing with the server.