If you select Filter recipients who are not in the Directory check box when you configure recipient filtering and if someone tries to send an e-mail to an address which does not exist in your Active Directory, the connection is dropped. While this eases the load on your server and helps with some attacks it also allows for an attacker to easily guess your internal e-mail addresses by going through the alphabet.
There are ways to block this at the Firewall level but now Microsoft provides a patch that allows you to block this kind of attack at the SMTP level by causing the SMTP engine to wait a configurable amount of seconds (Microsoft recommends 5) before dropping the connection. This is enough to make an alphabet type attack (called "directory harvesting") ineffective.
The patch is not yet available for download but you can obtain it freely through Microsoft PSS. If your Firewall, incoming mail relay or anti-spam package can thwart directory harvesting attacks then you need not deploy this patch.
For more information:
http://support.microsoft.com/?kbid=842851
