I have been running a Tor exit node for only 2 days on a fresh IP address. However, that IP address is now blocked by spamhaus because it apparently tried to contact the Command and Control server of the "pony" malware:
http://cbl.abuseat.org/lookup.cgi?ip=5.79.81.200
Other node operators, could you please try your IP address? Perhaps this could explain the recent increase in connections?