[brajkovic]

My guess is they have logs of every outbound TCP connection—it's not like Tor is the only protocol that can be used for evil.