Thanks for the helpful answers. Reps added.
I don't think the e-mail addresses listed necessarily forward to the domain owner. For example, the registrant e-mail address listed for one of the domains is
[email protected]. That's the addy listed for any register.com domain with private registration.
One of you mentioned certified offers. What I'm sort of curious about is how the certified offer services track down the domain owners. Do they have tools we don't?
Another suggestion to add to your list: use DomainTools' domain history feature to view archived whois records. Often the first archived record has privacy turned off, before the domain owner enabled it.