You are right. But sometimes, you may have some luck:

• Querying the DNS for the MX record of the host's domain may work. (But I've seen several LANs where DNS either giving no MX records at all or the wrong ones, unreachable on the other side of the firewalls.)
• The DHCP server's response may include option 69 "SMTP-Server". (Well, I've never seen that.)
• Try to resolve some common host names / aliases (mail, mx, smtp, mailer, post, ...; append 1, 2, 3, 01, 02, 03, -1, -2, -3, -01, -02, -03)

For each candidate, try to connect to the SMTP server on ports 587/tcp (submission) and 25/tcp (smtp).

(Occasionally, I've found LAN mail servers with a brute force nmap scan, scanning for servers with at least one of the two ports open. But don't do that without permission from the network admin, and never in foreign networks!)

Alexander