The most obvious way that this is working is as follows: - Checks the MX record for the domain name listed. - Attempts to connect to the SMTP port of the liste

The most obvious way that this is working is as follows: - Checks the MX record for the domain name listed. - Attempts to connect to the SMTP port of the listed MX record - Attempts to create RCPT TO lines using permutations of the name in common formats (firstname.lastname@, lastname@ firstletterlastname@, etc). Reports the first one back that is a match - which may be a major false positive as well: Connected to smtp.ins.dell.com (143.166.83.183). Escape character is '^]'. 220 pc-smtp.us.dell.com ESMTP HELO 250 pc-smtp.us.dell.com MAIL FROM: test@tester.com 250 sender <test@tester.com> ok RCPT TO: mdell@dell.com 250 recipient <mdell@dell.com> ok RCPT TO: michael.dell@dell.com 250 recipient <michael.dell@dell.com> ok RCPT TO: dell.michael@dell.com 550 #5.1.0 Address rejected dell.michael@dell.com RCPT TO: michaeldell@dell.com 250 recipient <michaeldell@dell.com> ok QUIT 221 pc-smtp.us.dell.com Connection closed by foreign host. I don't expect the majority of those to really go to the person listed as they are probably fielded by other employees first for legitimacy (just a guess).