This seems like a good place to collect use cases relating to anonymousity so I want to post another wrinkle from the dotLRN Course Evaluation requirements.
When a student fills out a course evaluation the UI should never associate a specific response with a specific student, even to an administrator. However, the system must keep track of the fact that a specific student has replied, so that they can only reply once, students who haven't replied can be spammed and reminded to reply, etc.
In addition, the people I interviewed would like to be able to find out who made a reply in extreme circumstances (for instance an abusive or threatening response). Having a programmer able to query the real user_id is sqlplus/pgsql would meet this requirement.