Sounds like they're just trying to brute force addresses. Sometimes their guesses will hit a valid address. And in those cases they can tell from the server's r

Sounds like they're just trying to brute force addresses. Sometimes their guesses will hit a valid address. And in those cases they can tell from the server's response, and can then harvest the address. If the address is the probe fit certain patterns, the mail server can have rules to look for those and black hole the host.