Try abuse@[domain] or the admin contact listed in WHOIS.
On smaller websites I’d be surprised if 1 in 100 of those goes to a person who reads the email sent there.
Also admin@… or even legal@… I usually check for a "contact us" web page, too.
To 15,000 email addresses? That's indistinguishable from a small-scale spam campaign.
On smaller websites I’d be surprised if 1 in 100 of those goes to a person who reads the email sent there.