Withdrawals in the db may have addresses and amounts, although RingCT upgrades make this more and more useless, but even without RingCT the addresses do not correspond to any information in the blockchain. The best case law enforcement would have had, before RingCT is to have seized the database of several exchanges, where users transferred Monero directly between both exchanges and they could see addresses in both databases. In this respect, Monero is much more akin to accounts at financial institutions, where subpoenas are needed to glean any information at all. But further enhanced by retaining the individual control of private wallets that cryptocurrency allows, where financial institutions are an embellishment to temporary user experience problems.

A server containing a user's trade histories would show amounts deposited with Monero. But it would not contain the addresses those deposits came from, the Monero daemon doesn't know this.

Similarly, the user's withdrawals wouldn't be to an actual address that they could cross reference. RingCT gives people one time use addresses. But even if you were somehow not using RingCT addresses the Monero user experience had a best practice. Since you cannot follow transactions to that address over the blockchain, you cannot guarantee that it was the real destination at all. Any user should just have two wallets and transfer to one, which would have the address in the exchange's database, and then in wallet B, transfer to wallet C. I believe RingCT removes that marginal inconvenience, as the addresses themselves are one-time (but feel free to correct me here).