So, we can try an alternative of passing mail to both sides of the firewall in order. Of course, this would rely on knowledge of internal network numbering. If you are wondering how to get this, two ways come to mind. If you are one of those wacky 'white hat' ethical hackers, this information is often given during a controlled penetration. If you are a malicious 'black hat' evil hacker, then trashing or Social Engineering might be an option.
Firewalls often allow a wide variety of traffic to go outbound.
So route a remote sendmail based attack to the internal host of your choice, spawn an xterm to your terminal and voila. That is it. Short and sweet. Expand your minds.