Indeed, not a lot of ways to associate an address with somebody unless:
- seize drives or papers with private keys
- extract printer memory if they printed a private key
- subpoena exchanges to hand over records to tie them to identities they have on file
- search if somebody put the address in a forum sig or on IRC/elsewhere and admitted it was their address
- check IP if they generated the address with an online wallet, brainwallet or some other discoverable method (not behind Tor)
Otherwise all you are looking at is a big chain with coins going from address to address and no way to prove somebody is the definitive owner of it.