One way to do this is to override the form's WndProc method and check for WM_SYSCOMMAND and SC_CLOSE. Looking for WM_CLOSE in the override is not sufficient as WM_CLOSE is seen in both cases. A sample is available for download (C#, VB).

public const int SC_CLOSE = 0xF060; 
public const int WM_SYSCOMMAND = 0x0112;

//_closeClick is a bool member of the form initially set false... 
// It can be tested in the Closing event to see how the closing came about. 
protected override void WndProc(ref System.Windows.Forms.Message m) 
{ 
  if ( m.Msg == WM_SYSCOMMAND && (int) m.WParam == SC_CLOSE ) 
    this._closeClick = true; 
  base.WndProc( ref m ); 
}

Contributed from George Shepherd's Windows Forms FAQ