Just grabbing the traffic from the exit node doesn't allow you to find out who is sending the traffic, unless the traffic itself has something that can be linke

Just grabbing the traffic from the exit node doesn't allow you to find out who is sending the traffic, unless the traffic itself has something that can be linked to the source. That's the magic of the layers in the network. There are certainly some other kinds of attacks that could deanonymize this who are using tor, but the attacker needs to have control of a big percentage of the network, and I actually hope other state actors run enough nodes to make this non viable.