Good question!

Looking into the protocol specification, you will see you need to route those messages. Ping and Query descriptors don't contain IP and port of the sender, but a GUID for routing. Only Pong, Queryhit and Push contain IP and port (for further contact/filetransfer).

Note: I never understood this design completely. Okay, we know all direct conections won't work to firewalled or NAT-routed peers... the routed way via the network does always work, since it does not establish a new (possibly blocked) connetion. But why we don't _try_ to direct connect to a peer first... or it's next superpeer? Is it a bad protocol design?
Anonymity could be an argument. The user searching is anonymous to the network, the content provider isn't (Queryhit descriptors contain IP of the sender). But on direct download each other knows the opponent's IP, together with a Push descriptor even more ppl know it. My conclusion = anonymity is very low or an illusion on Gnutella. Who cares if you search for chocolate-cake-recipes/porn/warez, when downloading or providing such content will uncover anonymity.
Passive searching and caching might be an argument together with superpeers (they could group searches together), but superpeers still don't direct connect the destination.
Or is this just all about a networking problem (rather than anonymity and stuff)... peers could never handle a high rate of incoming connections (limited nuber of sockets) + TCP lowlevel overhead is too big (SYN, ACK, FIN, ACK)? Someone with enlightenment?