sp_helprotect is deprecated but in my opinion is easier to use than its recommended replacements sys.database_permissions and fn_builtin_permissions. This page is for sp_helprotect, note the "Important" message at the top of the article.
http://msdn.microsoft.com/en-us/library/ms190310.aspx
sp_helprotect will not htell the whole story though. If the user owns an objects or is part of a Server or Database Role it can have implicit rights to some entities.
There are no special teachers of virtue, because virtue is taught by the whole community.
--Plato