Can shadow IT be found without asking employees?

Yes. Passive, outside-in discovery maps domains and vendor connections from the internet, the same vantage point an attacker has, so it doesn't depend on anyone remembering or admitting what they signed up for.