I believe the hacker discovered his email address simply by clicking on his profile & discovering the email there & the rest is history.
I am not sure about this. As
recently as June 28, BitcoinGirl.Club had their email address hidden.
Either the setting was changed since then, their email leaked from one of many database leaks of bitcoin related services, or someone knew their email address some other way.