You can scan IMAP servers by using this tool.
This script enumerates information from remote IMAP services with NTLM authentication enabled.
Sending an IMAP NTLM authentication request with null credentials will cause the remote service to respond with a NTLMSSP message disclosing information to include NetBIOS, DNS, and OS build version.
Set the Send NTLMv2 responses exclusively option in the Network security: LAN Manager Authentication Level setting. When all client computers implement NTLMv2, Microsoft and a number of independent organizations strongly recommend this level of authentication.