The hack
If any of the outbound tools list doesn’t find the email for you, this is the way to guess it.
Why does it work
To make email sending easy within companies, the addresses are usually a combination of first and last names.
The most common formats are:
This is usually used company-wide, so once you know the email format of one person, you can easily guess the others.
How to do it
Several tools test email deliverabilty for you. The most popular is Neverbounce.
Use their instant email validator and run the different email formats, until you find the once that comes out as Valid.
There are some edge cases. People including middle names or people that use nicknames instead of their regular names, make it more complicated to guess.
For example, Michael often goes with Mike, Mitchell with Mitch, Catherine with Cathy, and so on. For those, you’ll have to do a little trial and error.