The challenge is to merge different addresses that all correspond to the same user. Since bitcoin isn't quite as anonymous as it's cracked up to be, this isn't totally impossible to do.
One way to do it is to merge all addresses that contribute inputs to a single transaction. That's based on an assumption, but it's pretty reasonable one.
Another way: connect your computer to all other Bitcoin nodes. Whenever you see a transaction broadcast that you haven't seen before, log it and the IP it's coming from. Since you're connected to all nodes, that is the sender's IP (unless they're anonymizing with Tor or some such).
These approaches are used in a couple of papers:
http://anonymity-in-bitcoin.blogspot.com/2011/07/bitcoin-is-not-anonymous.html
eprint.iacr.org/2012/584.pdfhttp://eprint.iacr.org/2012/584.pdf
The estimates from those papers aren't totally current, but you could extrapolate. Ron and Shamir (2012) count 3,730,218 addresses and 2,460,814 "entities" (conservative estimate of users). So multiply current addresses by about 1.5 for a ballpark estimate.
