"Hi, I'm <x>, I'm trying to send an important email to <y> but it keeps bouncing. Can you confirm I've got their email address correct?"
Is super useful, even though It wouldn't give me the email I was looking for, it would show me the "structure" used for emails inside the company:
This is perfect for doing customer development, also if you are doing cold reach outs remember to follow the CAN-SPAM act.
Based on that I would just guest the email of the person and it used to work perfectly.
I've used this technique a bit, but a word of warning... it's definitely not always the case that all emails in a given firm match "the structure". Usually most of them do, but I have found more than one company with a mishmash of patterns for whatever reason.
Probably the most common thing I've noticed is that "important" people (CEO, etc.) may get a different email, and people with really long name (some Indian names fall into this a lot) may be truncated, or swapped out for just an initial.
Still, other than paying for addresses from Jigsaw or Hoovers, this seems to be about the best approach I've found so far.
Sure, they might think it's a little weird if they notice they're in the bcc field, but it sure is a lot easier than sending off a single email and spending the next few days wondering if it actually went through.
I'm assuming they used similar tactics to try to find my address
Sure he's not trying to tell you something? :-|
It is also better for the relationship. It signifies trust. And every time you hold something back (or lie) you risk damaging a relationship. In this instance, a recruiter might reach out to the employee some other way. The recruiter and employee would then figure out that the business owner may have withheld the mail, even though it was clearly addressed to the employee.