"This leaves few options to find out information about Satoshi. However, if the NSA ran a sufficient number of nodes, they could easily determine the first node to propagate a transaction. This would be Satoshi's IP address. That is why they would do this."

I suspect that there would be easier ways. Even just the time when the transaction occurs would reveal a data point (e.g. when the sender is awake). It also would not help much to avoid using exchanges; if the target mined their Bitcoins, then you can at least narrow them down to the people who could mine enough for the transaction (which becomes easier as transactions become larger). If the target was given the Bitcoins by someone else, you now have another transaction that can reveal some data points (e.g. when that transaction occurred, who sent the money, etc.).

Like I said, auxiliary information is key here. Sure, transactions in isolation might be hard to associate with a person, but transactions do not occur in a vacuum. If you want to speak rigorously about anonymity, you need to somehow include the notion that an attacker might have access to some information beyond the observations they make of the system; the point is that the system should not expand the attacker's knowledge (except by some negligible amount). This is the intuition behind concepts like "unlinkability" in academic work on digital cash: it should be computationally difficult to identify transactions that originated from the same spender (even better is the notion of transferable cash, which allows for "fully" offline payments; however, this has the drawback of causing the representation of the money to grow in the number of parties that have received it, and so it scales poorly [1]).

So, imagine a system where a party being watched by the NSA uses an offline protocol to pay another party e.g. they meet out in a field somewhere and do the transaction without any Internet connection. A system with divisibility and unlinkability [2] would make it hard for the NSA to track the target from the transaction, as the target could withdraw more money from the bank than he spends, and the receiver's deposit does not reveal which user sent the receiver the money (at least beyond what would be revealed by things like the timing of the withdrawals and deposits and the amount of money being deposited; the point is that the transaction protocol itself does not add any additional information). A system that supports transferable cash would take this even further: a party might receive the cash from one friend, then send it to another, both using offline transactions, and the NSA would not be able to identify "middle" party (or the "first" party that made the withdrawal).

Of course, these definitions cannot be applied to Bitcoin, for an obvious reason: these definitions call for a bank in the system, which acts as an authority on the validity of the money (sound familiar?) and which identifies "cheaters" e.g. double-spenders. On the other hand, there seems to be no good security definition for digital cash that does not involve such an authority; I suspect this has something to do with the lack of an economic theory for money with no intrinsic value and with no such authority.

[1] https://dl.acm.org/citation.cfm?id=1754992

[2] http://eprint.iacr.org/2007/216.pdf