Article 13(1) of Directive 2002/58/EC (in the UK implemented in PECR 2003) is about direct marketing. Article 95 GDPR explains the relation between that directive and the GDPR. The GDPR only applies if personal data is processed.
In a comment you confirm that the email address is like email@example.com. The European Data Protection Board has written a letter to the ICANN (regarding WHOIS) where it clarifies if such an email address is personal data:
The GDPR does not apply to the processing of personal data which concerns legal persons and in particular undertakings established as legal persons, including the name and the form of the legal person and the contact details of the legal person. While the contact details of a legal person are outside the scope of the GDPR, the contact details concerning natural persons are within the scope of the GDPR, as well as any other information relating to an identified or indentifiable natural person.
The mere fact that a registrant is a legal person does not necessarily justify unlimited publication of personal data relating to natural persons who work for or represent that organisation, such as natural persons who manage administrative or technical issues on behalf of the registrant.
For example, the publication of the personal email address of a technical contact person consisting of firstname.lastname@example.org can reveal information regarding their current employer as well as their role within the organisation. Together with the address of the registrant, it may also reveal information about his or her place of work.
In light of these considerations, the EDPB considers that personal data identifying individual employees (or third parties) acting on behalf of the registrant should not be made publically available by default in the context of WHOIS. If the registrant provides (or the registrar ensures) generic contact email information (e.g. email@example.com), the EDPB does not consider that the publication of such data in the context of WHOIS would be unlawful as such.
So at least because an email address like firstname.lastname@example.org is used, it gets inside the scope of the GDPR. But as Article 95 GDPR explains, only for matters which have no obligations in Directive 2002/58/EC.
Can I use GDPR to request how he found my address
As that is outside the scope of 2002/58/EC, you can use the GDPR to request this. See Article 14(2)(f):
Information to be provided where personal data have not been obtained from the data subject
In addition to the information referred to in paragraph 1, the controller shall provide the data subject with the following information necessary to ensure fair and transparent processing in respect of the data subject:
(f) from which source the personal data originate, and if applicable, whether it came from publicly accessible sources;
Regarding your second question;
Can I use GDPR to request that I be removed from his list?
The email you describe is clearly unlawful in respect to Directive 2002/58/EC, but also the GDPR would provide you with the right to erasure. So either way you can request to be removed.