Wallets X, X1, etc. aren't associated in any way to wallet A. Nor can input and output amounts be matched - unless someone gains physical access to the machine where John keeps his wallet, I suppose.
This got me thinking:
What prevents wallets A, X, X1 from being associated by IP address? There's no association on the block chain, but IP association is just as bad...