How are withdrawals handled?
Is this sytem dependent on trust between individual users?
No, it is a completely trustless system. The protocol itself debits every asset (except for BTC) from a user's address upon making a transaction involving that asset.
As for BTC: Both users involved in a transaction have to enter an 'expiration' (measured in blocks) for how long his order is valid. The user who is 'giving' BTC must do so before the shorter of the two expiration times has expired, otherwise the transaction is cancelled.
Is it possible for a user to issue currency for trade that they do not hold?
No.