From some cases in which I've been interviewed:
- A very large online footprint associated vaguely with the story.
- Knew the reporter socially.
- Knew the reporter through previous contacts. (Emailing the publication can do this.)
- Chaining through other contacts -- "oh, you should talk to ...".
That includes a decade or three's experience. Today with social media the task is much easier.
Various public filings (court records, consumer complaints to gov't offices, to watchdog groups) can also trigger journalist follow-ups, depending on the case.
The reporter very likely talked to 10x the people cited in the article -- one reason good journalism is hard. As with high-quality video and audio production, it's what's left out that makes what's left in much better.