The truth is they probably don't know. These days the process of guesstimating an email address behind a LinkedIn profile is highly automated. Very often what a recruiter see on their dashboard is basically a list of potential candidates' LinkedIn profiles, paired with a list of plausible email addresses for each of them (with no indication of how the bots got them in the first place).