I think, for the sake of argument, you should simply assume all the services used here are compromised.e.g. Tormail, Instawallet etcYou don't have to be paranoid, you just shouldn't make any assumptions about privacy.