C&D is sometimes sent first, but not always.
Respondent is typically notified by email and postal mail.
The Whois information is used; little to no research is done by the arbitration company as to who the respondent is - they rely on public information, in particular Whois, and occasionally information provided by the complainent and/or other sources, such as a webhosting company, etc.
UDRP is typically done solely by email / postal mail.
Not responding to a UDRP most often results in default (losing) though occasionally a non-respondent gets lucky.
The registrar(s) will typically lock the domain(s) that's under UDRP in some fashion; for some TLDs / ccTLDs it's done at registrar level, for others it's done at registry level; many variations of how this happens, since TLDs vary so widely in their policies and implementations.
When one loses a UDRP challenge, the domain typically does not automatically disappear, but rather is held for a period of time (10 days or so typically) to allow the respondent the option of pursuing the matter in court...
UDRP isn't always the end, since the complainant can still go to court ... nor let alone even always the beginning - in some instances a court case can occur first with no UDRP ever being filed ... doesn't happen often, but when it does, the registrant can find themselves in a situation much worse than any UDRP challenge.
Ron