If "someone" doesn't have access to any of the services, there's no way he can tell that the final TX is connected to you.
If "someone" had access to only ShapeShift data, he'd know to which Monero address you withdrew, and how much. He could suspect when you move those funds elsewhere but never be sure if it was you or it just so happened that someone else used your output as "decoy". Even if he assumed that you moved the coins, he'd have no way of telling to which address or how much. He'd just see that you maybe moved those (or part of, he can't tell) coins somewhere.
If "someone" had access to only MyMonero data (or forced MyMonero to collect whatever data it can), they wouldn't know from where your balance came. They wouldn't know who "you" are. The source and your ID would remain hidden. When sending, MyMonero could know the amount. If sending to a non-MyMonero user, they wouldn't know the destination address. If sending to a wallet also registered at MyMonero, they could also know the destination address.
If "someone" had access to both MyMonero and ShapeShift, they'd know who you are, how much you received and how much you sent. If sending to a non-MyMonero user, they wouldn't know the destination address. If sending to a wallet also registered at MyMonero, they could also know the destination address.
If "someone" got access to only recipient data, they wouldn't be able to trace it back to you. If they got the recipient data and ShapeShift data, they'd have a loose link but wouldn't be able to prove anything.
If "someone" got access to recipient, MyMonero and Shapeshift data, they could establish the link.
The only way to protect against someone coercing all involved services is to use an independent wallet instead of MyMonero and do some "churning" before sending to final destination. That way, even if someone had the recipient and ShapeShift data, you'd have fuzzed the trail enough to erase any suspicion.