-snip-
How do you distinguish change addresses form normal outputs?
I found the refined version of Heuristic 2.
The simplest way is to identify the transactions that only have two output addresses.
And only one of the output appears first time in the blockchain (new address).
The new address will be identify as the change address.
-snip-
Its not correct. I have seen people asking to send Bitcoins to new addresses due to privacy concerns. I don't think "heuristic 2" will work. I might be wrong though!