The pump works because Nature hates the idea of empty space and so fills it with whatever it has at hand. Give Nature enough time, and it will find a way to break the seal of a Thermos bottle and fill the vacuum that keeps soup hot and beer cold.
This idea of an absence of something enjoying only tenuous existence because the environment will always endeavour to provide that missing substance is, I believe, a nice analogy for anonymity.
What is anonymity but an 'identity vacuum' (its etymology means "without a name")? Anonymity refers to a state in which there is insufficient identity information to allow a user to be identifiable within some set. So, like a vacuum, it's a state defined by the absence of something, namely identifying information. Also like a vacuum, anonymity need not be absolute, you can have partial anonymity as you can have partial vacuums.
Importantly, anonymity is a tenuous state. Like air rushing in to a crack in a thermos bottle seal at the first opportunity, identifying information will always (eventually) leak into anonymity from the environment. However well a system is designed to enable anonymity, outside forces are always trying to find a crack through which identity can be pushed. The leakage may come from recognizable facial or voice characteristics in off line interactions, or from an IP address or buying patterns in those engaged in online. But, wait long enough, and it will happen. Anonymity, like a vacuum, is a fragile state of being (and should be recognized as such).
From this exploration, I posit the following (dare I say it) 'Law of Identity':
If there exists a region of anonymity relatively devoid of identity, identifying information from the environment surrounding that region will attempt to redistribute itself so as to fill said void.As an exercise I leave it to the reader to develop the "'Surfing Adult Sites at Work' Corollary".