I'm assuming 10^12 tries per second is economical for any business.

there are about a million words, including all likely spellings of all but the rarest first and last names, so all 1 or 2 word addresses, firstname.lastnames, etc. addresses are about 10^12. try those, plus short alphanumerics, for the 1000 most common email domains -> 10^15 addresses

Throw in every name in public leak databases that doesn't meet those patterns as well.

There's on the order of 1 million domains that are likely to be serving mail at all; try the billion most likely names for each of those for another 10^15.

This should capture almost every email address that isn't an intentionally obfuscated one-off and adds up to less than an hour at 10^12/sec. There's a modest overhead to matching against a larger list but it shouldn't matter in practice