Can you get someone in work to send you an email.
This will contain the dns name or IP Address of their mail server.

Or Social Engineer, send a general enquiry to their info@ email address and have the receptionist respond.