It does SMTP requests, trying to send mail (and aborting) to check the emails. It first tries a bogus gqjcqjcbhkjxcg@thedomain.com to see if the server throw an

It does SMTP requests, trying to send mail (and aborting) to check the emails. It first tries a bogus gqjcqjcbhkjxcg@thedomain.com to see if the server throw an error (and was not config as a catchall), then for Bill Gates, tries : - billgates@ - gatesbill@ - bgates@ - gatesb@ - bill@ ... - bill.gates@ ... but they don't try bg@thedomain.com The results also depends of the order of the tests. If you have bill@ that redirects to bill.gates@, as they try bill@ before bill.gates@, it will tell you that bill@ is the address. Clever, but used by spammers and list makers for years (those who scan whois domain infos and reconstruct the email with your name and the domain).