Queries any email address:

dsquery * domainroot -filter “(&(objectClass=User) (proxyAddresses=*user@domain.co.uk*))” -l  -attr name mail proxyAddresses sAMAccountName

Only queries primary email address:

dsquery.exe * -limit 0 -filter “(&(objectCategory=person)(objectClass=user)(mail=*))” -attr name mail