I actually think it would suffice to payout at random times with an insanely high number of bitcoin addresses (all autogenerated via a script) for high number of users (the more the better). It would be virtually impossible to know who got how much BTC out (may be in, but not out).

As for the hostile mixers, I'm afraid I can't offer any solution other than to rely on reputation. That said, it is rather telling that bitmixer.io is closing [https://news.ycombinator.com/item?id=14843373]. It may not be safe to run a mixer; the feds may come after you.