So I know this is likely to be brushed off by some as not true, but after several hours of screwing around I did in fact get the passcode. It was 1216.
After reading a bunch of forums I almost thought it wasn't possible, but it is (I don't think it is with the 4S, but it looks like most other phones can be cracked). Like I said earlier, I downloaded Gecko iPhone Toolkit (yes, I had to bust out the Windows machine since it's an .exe).
If you're curious, there is a decent article about it here:
www.howtoarena.com/xry-is-not-the-only-software-which-can-crack-your-iphones-passcode/
It wasn't as straightforward as the article leads one to believe. I'm not a hacker or anything, so I was nearly stumped when the "Unexpected Parameter" message about i4ramdisk.dmg came up. However, another article (forum.gsmhosting.com/vbb/archive/t-1441284.html) helped me out with that issue.
If you follow the instructions exactly, it totally works. Side note: I did find that DFU mode was really hard to get into until I watched this:
http://www.youtube.com/watch?v=rMujSKuKmnY
Like I said, I'm not some big-time programmer or anything, but it looks like what it does is put the phone into some kind of mode where Gecko can attempt to change the password repeatedly without any of delay rules normally imposed by the OS. Once it hits the correct password it just shows it to you.
The only piece of "new" knowledge I have to contribute is this: There were no instructions anywhere I found on how to "escape" the DFU/Redsn0w/Gecko mode once it got the passcode, so I just held my breath and unplugged it, and held down the power and home buttons until I saw the apple. I released the apple and it booted up to the passcode screen. 1-2-1-6 and *click*. Woo-hoo!
Although I still don't know exactly who owns the phone (I looked at a couple emails, but I really don't want to snoop any more than I need to), but I can see who's been calling him, so when it gets to a reasonable hour, I'll start calling them and see if I can get a name and address and drop it in the mail.
Yes, I admit, it was an extraordinary effort to help out this random dude, but it's been very educational and a good lesson for me: I'm going to put an "If found" message on my lock screen in case I ever lose my phone and the person finding it is nice enough to return it.
Other lesson learned: Nothing is private!
PS. Yes I know my story is crazy. I can't imagine how a phone ended up in my ditch unless it was thrown there (or perhaps stolen by someone and tossed there). Also, I have no idea why the lady who found the phone would give it to me for some cans. She didn't seem "savvy" if you catch my drift, and maybe she didn't know what it was worth. I swear, I couldn't make this stuff up if I tried! Haha. Welp, I've spent far too much time on this endeavor and now I have to run... I would say "thanks", but none of you really helped me

----------
PPS - To those of you saying to take it to the police: call me crazy but part of me simply doesn't trust that the police or even ATT or Apple will REALLY try to find the owner. And, yes, I totally admit that I contemplated keeping it, but I just started thinking about whoever lost it, and I realized if I were in his shoes I would really want my phone back. They're expensive!