Some people at DebConf 7 were (like Mario) wondering how many users Debian has. They realised that while we have a distributed mirror network we do have all installed systems use security.debian.org by default and we do have control over that. Since apt will only download files when they have been changed we can make a minimal estimate by looking at the number of downloads of the release files while they remain unchanged. Obviously, this will only be a minimum – for example, some users won’t have network access, some users will use caching proxies or local mirrors – but it’s a start.
Unfortunately I can’t actually remember the numbers they came up with but perhaps someone could enlighten us.