using email to scan for mail servers ?

[Darren Reed <avalon () coombs anu edu au>]

Does anyone know of (un)successful attempts at using "foo@[ip#]" style
mail addresses for scanning of mail hosts ?  It occurs to me that this
would have some potential for the simpler firewall scenarios, but with
the advent of relay blocking (and sites not being configured to accept
email to their own IP#'s) that any real potential has already passed.
I'm, assuming it's not a sendmail-only addressing feature.  It is also
the sort of scan which you're not going to be able to run from your
Ballista/ISS scanner since nacks or acks may take days to arrive back.

Darren