See here for one explanation of this: [tor-relays] preventing DDoS is more than just network filtering