Finding addresses via university public alumni sites.
I recently found that my university alumni site posted my new address when I moved, even though I did not post it myself. (I'm assuming they did so after receiving a change of address for the alumni magazine via the post office.) I happen to be a registered user so I have my address set to private. However, non-registered alumni are also listed on the site, which means the university lists their names and their last known addresses. Because they aren't registered users they have not set their information to private, which really should be the default setting, in my opinion.
I just happened upon this information when I went to my profile recently to update it and add some relatives to my profile who are also alumni of my university. Some are registered users and some are not, which is shown on their page I'm assuming so that you will know whether or not to expect a response from any attempted interaction with the person via the site. What it told me was that the university is posting last known addresses even for non-registered users. Without going into detail, I think even just one interaction with the university can trigger the address change. So, even someone who thinks they are covering their tracks and just has that one interaction without purposely changing anything could end up having their new address listed publicly without their knowledge.
So, you might try looking at the alumni site of someone's alma mater and see if there is an address listed there, which they might not even realize is posted. This might not be true for all colleges and universities, but it is for mine, which is a very large public university.