If I was to search the blockchain for address X, then I see that it has two inputs in a transaction, X and Y.
I can safely assume that X and Y are owned by the same person?
That's usually the case, but not always. They could be owned by different people who have cooperated. It is possible to do this in such a way that neither party reveals their private key to the other.
Now if I look at all of the transactions for Y, and I see that it has a transaction with two outputs, Y and Z.
Then I can now assume that X, Y and Z are all owned by the same person, right?
No, that's not a good assumption. When a transaction has two outputs, there is no reason to think they both belong to the same person. In fact, a more common case for two-output transactions is that one of the outputs is the "real" payment, and the other is "change" that goes back to another address belonging to the same person who sent the payment. (See How does change work in a bitcoin transaction?) However, there is no way to be sure which is which.
If a wallet has 10 addresses, then could I not get all of those addresses using the above method?
Nope. If you continue in this way, you'll pull in a vast number of addresses belonging to different people who were paid by your initial target (and people who were paid by them, etc, etc). You'll also miss any addresses from the wallet that have been used independently, if they've never appeared together in a transaction with any of the other ones you saw.
