SMTP/s - TCP 25, 465, 587

Open relay

telnet <target> <port>
EHLO <target_fqdn>
MAIL FROM: <[e-mail]>
RCPT TO: <[e-mail]>
DATA
<text>
.

List available SMTP commands with Nmap

nmap -p25 --script smtp-commands <target ip>

Enumerate users with VRFY

telnet <target ip> <target port>
HELO x
VRFY root

Enumerate users with RCPT TO

telnet <target ip> <target port>
HELO x
MAIL FROM:[e-mail]
RCPT TO:root

Enumerate users with EXPN

telnet <target ip> <target port>
HELO x
EXPN root