Consider the following transaction:
https://blockchain.info/tx/aa5eb27652bd85dc444ea2508bf0ff6ff1b484141e2d7e69f31976fafb21e06e
Each of the output addresses has never before been used, and there is only one input address. Why does blockchain.info guess that 0.7695 BTC has been transacted with 3.7216 BTC as change rather than the reverse (see "Estimated BTC Transacted")? Does it just pick the second address as the change address?
In other cases, I am able to guess similarly to blockchain.info, for example:
(1) If multiple input addresses are used, the change address should not be greater than the lowest input address (unless, of course, this is being purposely obfuscated).
(2) If both of the output addresses have been used before, they may run a degrees-of-separation query to try to connect one of the output addresses more closely to the input addresses, more closely identifying it with the input addresses and therefore as the change address.
(3) If only one of the output addresses has been used before, it is more likely to be the change address according to the heuristic in (2) because by definition the used address is more closely "connected" than an address that has never been used.
But what heuristic could be used if each of the output address is new? The spending pattern of the input address? Randomness? Thoughts?
You can see how this question affects views of the total/daily volume on Bitcoin in aggregate by comparing/contrasting both of the "Estimated Transaction Volume" charts available on http://www.blockchain.info/charts. They claim the second chart adjusts for change, but provide no details about the algorithm.