Hi there,
Here is a quick script that lists all SMTP addresses for a given domain on an Exchange 2007/2010/2013 (and probably 2016 too) server.
The script dumps a raw, unsorted list of SMTP addresses to a text file that can be directly consumed by, say, Symantec.cloud to populate its recipient validation list (this was the purpose I produced it for).
Download it from https://gallery.technet.microsoft.com/Find-all-SMTP-addresses-9dc01450.
The NMF (Not My Fault) licence applies. Test it first and use it at your own risk.
Enjoy :-)