Yeah, smtp relay is alot of fun sometimes. Some other ideas would be to actual use telnet like it should be used. Jump into servers and find out if the anonymous account allows for read/write perms. Another thing to use telnet for is to find out what they are running on certain ports. This is old school I know but banner grabbing is still useful. Instead of telneting to port 25 like you seem to be doing, try port 80 and see what it tells you. Just some ideas, hope it helps.