For all users that have an Exchange mailbox, write ALL their email addresses to a file

Although this can be done with ldifde, or possibly with csvde, I've never been terribly skillful with either of those utilities. So, this little vbscript will scrub your AD looking for anyone that has a value in the homemdb attribute. This generally means they have a mailbox on an exchange server somewhere, and thus should have an smtp addres in the proxyAddresses value in AD. This script does user accounts only, not contacts, groups, or anything else that might have an smtp address. If you're trying to search your domain for a particular smtp address to see where it's being used I have a script that does that as well, located here.

This is a pretty standard script, it uses a sql type query to gather all user accounts, then does some standard looping to sort out the ones that actually have mailboxes. Since the proxyAddresses attribute is 'multivalued', meaning that it can hold more than one entry, we have to sort through all the possible entries for that value. I also incorporated some string searches to drop the X400 address and any holdover MBX values so we get a nice list of JUST smtp addresses.
'***************************************************

On Error Resume Next
Const ForWriting = 2
Const OpenAsASCII = 0
strOutputFile = "c:\SmtpAdds.txt"

Set objRootDSE = GetObject("LDAP://rootDSE")
strDomain = "LDAP://"& objRootDSE.Get("defaultNamingContext")

Set objFSO = CreateObject("scripting.filesystemobject")
Set objOutputFile = objFSO.CreateTextFile _
(strOutputFile, ForWriting, OpenAsASCII)

Set objConnection = CreateObject("ADODB.Connection")
objConnection.Open "Provider=ADsDSOObject;"

Set objCommand = CreateObject("ADODB.Command")
objCommand.ActiveConnection = objConnection

objCommand.CommandText = "<"& strDomain &">;(objectCategory=person)" & _
";distinguishedName,cn;subtree"
objCommand.Properties("Page Size") = 6000

Set objRecordSet = objCommand.Execute

While Not objRecordSet.EOF
strUserDN = objRecordSet.Fields("DistinguishedName")
set objUser = GetObject("LDAP://"& strUserDN)

If instr(objUser.homemdb,"CN=") <> 0 then
objOutputfile.writeline objUser.displayName

For Each entry in objUser.GetEx("proxyAddresses")

If instr(entry,"X400") = 0 Then
proxy1 = entry

If instr(proxy1, "MBX:") = 0 Then
objOutputfile.writeline proxy1
End If
End If

Next
objOutputfile.writeline
End If

objRecordSet.MoveNext

Wend

objConnection.Close

Set objRootDSE = Nothing
set objConnection = Nothing
set objCommand = Nothing
set objRecordSet = Nothing
set objUser = Nothing
set objOutputFile = Nothing
set objFSO = Nothing

wscript.Echo "All Done"