SMTP <tcp 25>

nmap -p25 --script=smtp* 192.168.160.136 -v

telnet 192.168.160.136 25
VRFY root
EXPN root

smtp-user-enum -U users.lower -t postfish.off

Usernames can be based of names and or departments