Why would you consider sending an email to an address that you know does not exist within the company you are performing a Penetration Test for?

NDR bounce messages expose server configuration and software details - they have no mechanism to identify the owner of the root account.

A single message sent to one invalid address generates only a single bounce reply and cannot cause a denial of service condition.

Spam requires mass delivery to valid recipients - sending one message to a deliberately invalid address is a targeted recon technique, not spam generation.

When an SMTP server cannot deliver a message it returns a DSN/NDR bounce containing the mail transfer agent name, version, and sometimes internal relay hops, giving a penetration tester passive reconnaissance data about the email infrastructure without requiring active probing or authentication.

Testing virus protection requires attaching files with known malware signatures; sending to an invalid address tests SMTP server behavior, not antivirus scanning.