The point is, as it's a hidden service, you don't know. It would defeat the purpose if you knew who was running it. I know there are concerns with that, "It could be a honeypot!!" etc. Though it's also the reason why you would use GPG/PGP to encrypt your messages with the people you are conversing with. So, even if it is a honeypot, they wouldn't see your data.
So why is it better to use tormail.org than to use crypto and send from your real mail server? You don't want the ISP to see your SMTP headers? You don't want the address you're mailing to recorded on your typical SMTP server (probably Gmail and therefore subject to uninformed subpoena and/or warrant)? It seems in most cases, unless you're trying to mail osama.bin.laden@alqaeda.org, it wouldn't be a problem to use conventional SMTP headers.
i.e. the long and short of this issue is, if there's a problem with someone seeing the SMTP headers on your mails, you're doing it wrong. If tormail is a honey pot, it's a much more concentrated source of suspicious data than the inconspicuous mail sent through Gmail or another typical route, and therefore those routes may in fact be much safer, because your mail is not likely to come under any scrutiny there unless you try really hard to call attention to yourself (by sending mail to the recipient listed above, for example).
As far as I can tell, the advantage of using tormail (the hidden service) coupled with GPG/PGP is simply the added layer of security (which is anonymity). Like I stated before, Tor isn't necessarily for privacy. It is all about anonymity. So if a person doesn't encrypt their messages there is a (slight?) chance of their messages being read. This could lead to compromising your anonymity and privacy.
With GPG/PGP encrypted messages, you will not have this problem as much.
If a person is only seeking privacy then GPG/PGP is more than enough to secure their messages (while keeping in mind the headers are visible - just alter it).
It think tormail is great for journalists etc. who need anonymity to protect themselves from dangerous times. That's about the only thing I would use it for.
So, basically, the only benefit is that your IP is not exposed. I think there are much better alternatives than Tor for that, and I definitely don't think it really justifies using a custom "private" mail service that easily could be a honey pot.
I use PGP for as much mail as I can on my normal server. Even if you use PGP, it's still not a good idea to use a honeypot unless the risks at play have been carefully calculated aforehand. We want the available attack surface to be as small as possible, for lots of potential reasons: PGP mails can be encrypted incorrectly either by operator error or a bug in your crypto stack, recipients may be able to be divined from the crypted message, the government may have a secret weapon capable of decrypting certain messages, the government definitely can make an educated attempt if they determine your content is high-value, etc. etc.
Basically I think a good privacy setup shouldn't need to include anonymously-run services like tormail that are just as likely (if not more likely) to be honeypots as honestly run by a kind-hearted security enthusiast with impenetrable integrity.
That's a good point. Tormail is 'produced independently from the Tor® anonymity software and carries no guarantee from The Tor Project about quality, suitability or anything else.' Further information is not available.
