If your pull requests are kept around you can simply check that the second parent of every merge to master is a pull request.
Github keeps pull requests as refs so you can list them with git ls-remote u://r/l refs/pull/*/head
, trying to find an equivalent on Atlassian's service felt like swimming in lard so you get to figure that out yourself.
For repos that use the Github convention for publishing pull requests, something like
awk 'ARGIND==1 { prhead[$1]=1; next}
!prhead[$3] { print $0, "was not merged from a pull request" }' \
<(git ls-remote u://r/l refs/pull/*/head)
<(git rev-list --first-parent --merges master --parents)
will do it.
You can (unsurprisingly enough) push anything the repo's set up to accept, so before your restrictions were in place someone could have pushed a fast-forward. Those will show up as non-merge commits on master:
git rev-list --first-parent --no-merges master
will list every commit that was made on master and not merged.