Mail transfer — enumerate users via VRFY/EXPN/RCPT, test open relay.
nmap -p25,465,587 -sV -sC $t
nmap -p25 --script smtp-commands,smtp-enum-users,smtp-open-relay $t
smtp-user-enum -M VRFY -U users.txt -t $t
smtp-user-enum -M RCPT -U users.txt -t $t