If it were me, I'd do prime decomposition on the amounts, calculate their relative magnitude, a boolean value indicating whether they'd been seen before, etc., label a number of training examples, and have a support vector machine generate a classifier.
There's a million other ways you can do it and get decent results. Doesn't stop it from being a WAG though.
In a typical two-output tx created before ~
2013-01-30, there's
a good chance the first output is the change address. Maybe even longer, depending on how long until the fix was widely deployed.