I agree so far.
> Until proven otherwise, the 'tor' user [operator?] is a suspect
The burden of proof lies with the police, not with the suspect. If the police fails to come up with reasonable evidence, the operator is to be acquitted, furthermore the operator has to do nothing to aid the police. It's definitely not up to him to prove the child porn isn't on his computer.
This is an important point. Consider what happens if the seized hard drives were encrypted (I don't know whether this is the case). Then it's virtually impossible for the police to prove that the operator was downloading the data himself. The operator on the other hand is not required to give up his passwords. In the end it all comes down to the question of whether relaying data via Tor is in itself enough to constitute an offense. And this is the question we all care about so much, because it will have implications for all exit node operators in the area.
> watch a few episodes of CSI if you want to get a rough idea how it works.
Oh come on.
Please don't watch CSI if you want to see how anything works. CSI is bullshit from top to bottom. If you want to see reality, watch "The Wire".