I may have forgotten the specific details of the unlinkability (been away from that for some months) but afair the IP address can be associated with a total payment amount and the output addresses. The unlinkability only creates a new address for each payee for each payment, but doesn't hide this new address. Thus on the next spend of the change, the input to the ring it likely known. It is these sort of combinatorial attacks (other variations) that I think might breakdown Monero's anonymity. Smooth please do correct me if my recollection has failed me.
You clearly smarter than me but the reason I do not worry is because I2p integration will come to Monero.
I am not sure if I am correct on the IP correlation, but I surely don't trust Tor due to Sybil attack on relays, timing analysis, etc. I don't know if I2P has defeated those issues. I doubt it but everytime I looked for detailed design docs in the past I didn't readily find the information I needed to formulate an opinion.
i2p is somewhat better because of what they call garlic routing where multiple separate messages are deliberately combined to frustrate timing/traffic attacks. I don't know of a careful analysis of how effective that is, but at least they try.