Weird. I've disabled verify in Postfix on my mailserver, but it still can introspect email addresses:

disable_vrfy_command = yes

smtpd_delay_reject = yes

smtpd_helo_required = yes