Ever spent some time searching online for someone’s email? A guess, or a Google search for their name and the word ’email’ often works. A tool I’ve used a few times which can have better results is the curiously-named VoilaNorbert. With this, you enter the name of the person you’re trying to track down, and the company’s domain name (or possibly just name; predictably it seems to have a lot of domains on file). You can do a fair number of free searches, although bulk ones are very cheap.
As an alternative, there are a few other services listed here, or it can be worth subscribing to LinkedIn Premium and contacting people through the mail system there.