The following features in content repository (community and enterprise) use Lucene QL.
Potentially not all of these queries are executed against search engine, some of them should be fine with TMDQ. The list may not be complete.
blogsearch.get.js and BlogServiceImpl
categorysearch.get.js webscript
IMAP command-search.js
CMIS
FreeMarkerWithLuceneExtensionsModelFactory (Lucene date formatting)
DiscussionServiceImpl
Repository JavaScript API org.alfresco.repo.jscript.Search
LinksServiceImpl
LockServiceImpl#getLocks (deprecated)
FileFolderServiceImpl#search -> CIFS, perhaps also FTP and everything that is using FileFolderService Java API
AuthorityDAO#findAuthorities
SiteServiceImpl#findSites
TaggingServiceImpl#findTaggedNodes
Admin Console