I wasn't going to say anything on this but, as other techniques seem
not to have worked I'll tell you what I do in such situations.

I do several scans, various permutations, perhaps an nslookup
or a whois.  With the listserv scans I can usually narrow it down to
a few possibilites, then maybe I do the whois or nslookup.

Then, I send a personal note, not using listserv, explaining the problem
to possibly suspicious addresses which may be related.  Nine times out of
ten I get, direct to me, a bounce which traces back to the offending
address through a subscribed address.  The innocent send me a note "not
me" (I get to see their email header, maybe they're wrong, just forgot
about that). If that fails I do more serious checking.

I have yet to find one I could not track down, though some take a lot
more time and work than others.

Douglas