You can write a python script that procedurally generates email addresses for a given domain, tries emailing them, and if the server doesn't return an error saying the account doesn't exist, add it to the database.

It may take a couple of centuries/millenia, and you might have to deal with anti spam measures, but you'll save $165/mo