I'm asking a couple of Tor questions today (they're unrelated), and one of which (I'm hoping it's a simple one) is that my understanding is that all requests will be delivered to a server from an exit node. Despite the fact the request has been encrypted and pushed through an arbitrary amount of nodes before it gets there, is the exit node now not the one seemingly responsible for any malicious activity?
E.g. an injection attack is made as part of a web request, and somebody decides to trace the apparent origin of that request - surely the exit node is now the node under investigation/suspicion?
If, for example, I chose to navigate via Tor for a totally legitimate/ethical task, there is a real possibility (if not a probability) that traffic appearing to come from my IP was part of something totally illegitimate. An attack, or worse. Surely, at some point, in the history of Tor, somebody must have been contacted by law enforcement regarding traffic apparently originating from an IP they had? And if not, why?