RT uses DBIx::SearchBuilder for it's SQL, you can look into $RT/lib/RT/SearchBuilder.pm for how exactly (where $RT is your RT installation dir).
in reply to deciphering RT source code layout
One thing that took me a while to figure out is that methods for all RT objects (Queues,Tickets, ..) are a little scattered across files. I haven't found a good description for it's API yet, so I'm using the source to find what methods can be called on certain objects. For instance for Tickets, there is $RT/lib/RT/Ticket.pm $RT/lib/RT/Ticket_Overlay.pm , $RT/lib/RT/Tickets.pm $RT/lib/RT/Tickets_Overlay.pm , $RT/lib/RT/Tickets_Overlay_SQL.pm , and inheritance of course.
I created myself a quick-and-dirty overview of methods like this (while in the $RT/lib dir):
find . -name "*.pm" | xargs egrep '^sub'