Interesting approach. I wonder if you could ping the iCloud servers to figure out if an email is associated to an iCloud account (I.e. for FaceTime validation). But imagine it's pretty locked down...
yeah potentially -
I think you can potentially detect which email clients emails open in, so you may gain some interesting insight once you've sent some cold emails.