My understanding of how email works is: for each email sent, there's a sending and receiving server that exchange a message between users on each. * If a serve

My understanding of how email works is: for each email sent, there's a sending and receiving server that exchange a message between users on each. * If a server tries to send an email to a user that doesn't exist on another server, the email will "bounce", and the receiver will automatically respond with an error (we've all seen this). * If a server slowly spams another server with emails to invalid users (say once an hour) they'll just get bounced back each time. No harm done. * If a server spams another server with an onslaught of emails, even if they are to a valid user, at some point it becomes a DOS attack and the IP of that server will be blacklisted. So the case you're probably concerned about is the second one where they could essentially brute force a username slowly enough that they don't trigger any red flags. But the time investment, compute power, and bandwidth necessary to do that is not worth how easy it would be to mitigate that. "Great you figured out my email address. Blocked." If they're going to spend time shooting into the dark like that they might as well be guessing random passwords to public facing ssh servers (which bots are doing all the time).