As far as I know, any scanner which does a HELO will be enough. It takes very long to scan whole ip ranges, though, so without ditributed scanning (botnet) you will not be very successful.
However, I do not recommend using open relays as, in most cases, they are blacklisted everywhere and...