That's not how it works. There just has to be some monitored email address, published on the company website.

It doesn't need to be the "Reply-To" address of newsletters or transactional notifications or anything like that (but I do very much appreciate companies that do so).