One way to do this is to have a wordlist containing usernames you'd like to try. You can get these anywhere, if you can find a list of employee email addresses you can try those. Backtrack comes with tools that can be used to get that information (see theharvester and metagoofil for example). Once you've compiled a wordlist, you can read through it and use curl against each username:
Code:
#!/bin/bash
while read line; do
curl -s -f http://123.123.123.123/~${line} > /dev/null 2>&1
if [[ $? -eq 22 ]]; then
echo "no such user ${line}"
else
echo "found user ${line}"
fi
done < users.txt
curl returns error code 22 when it encounters a 404 HTTP error, which is what you'd typically get if the user's page doesn't exist.