How can you build a messaging system where the delivery service doesn't know where to deliver something?
The return address is contained inside the encrypted portion of the message so only the recipient can see which address sent the message. The message should also be cryptographically signed with the senders private key so that the sender can be verified.
Next, the DHT key would likely be a hash of the recipients address so it would be difficult or impossible to determine who the messages in a specific bucket belongs to. Also since the service would only be accessed through tor or i2p, the actual sender and receiver would be hidden. Obviously the recipient address (or rather DHT key) must be known so that the message can go to the right place.
Also obviously anyone can technically retrieve anyone else's messages but since they are encrypted this shouldn't matter.
- covered some of these issues, with pros and cons of various ideas.