What's your process for finding out someone's email address?

Work out the company's format from any address that's public, a press contact or a support email will do. If they use firstname.lastname@ for one person they almost certainly use it for everyone. Build the address for the person you want and run it through a verifier before sending, because a bounce does more harm than not emailing at all.