To be precise, transactions must explicitly state all output addresses, and the default behavior of the client is to transfer the "change" back to a new address

To be precise, transactions must explicitly state all output addresses, and the default behavior of the client is to transfer the "change" back to a new address owned by the party doing the transaction to increase anonymity. It is however possible to redirect the change back to the original address.