So now you have to have an email account somewhere that allows anything and everything to be sent to it (no spam filtering), and you need a system to send emails and correlate that with received emails. This is all certainly possible and not necessarily that difficult, but compared to seeing if a service is running on port 25 it's about a hojillion times more hassle.

You don't need to send. Send "helo", "mail from" and "rcpt to" commands and most servers that are not open relays will reject the message after the rcpt to. Issue a "data", and most remaining ones will. At which point you can disconnect without sending any e-mails. Open relay testers are dime a dozen.