Doesn’t the WHOIS info have it? Even if it’s masked by the registrar’s privacy features, there’s still some email address that can be used.