The argument --host must be the hostname or IP address of Zimbra Collaboration Web Application root page, and --userlist an list of usernames to check against it.
root@kali# ./cve-2018-15131-user-enum.py --host http://mail.target.com --userlist /tmp/emails.txt
And it should spill out valid e-mails!
References: https://bugzilla.zimbra.com/show_bug.cgi?id=109012