ehh a Sybil attack involves breaking identification systems (eg, cracking private keys). In this case it seems like they've broken the underlying protocol (tor) to get the ip address.
A Sybil attack is any attack that involves attacking by brute forcing the number of identities. The identity need not be based on cryptographic systems -- it could simply be the number of IP addresses.
Sure but Sybil generally refers to obscuring identity as opposed to actually actively breaking into systems... This seems like a much more active attack if it involves forged packets.