in reply to Retrieve an email address of sysadmin only knowing the IP address
One way you might want to do it is querying the ARPA hostname associated with the IP address. For for an ip address of 1.2.3.4, this would be something like 3.2.1.in-addr.arpa. Don't forget that different ranges of ip address will use different whois servers though (eg European addresses will use whois.ripe.net).