If the police are sophisticated enough to track illegal activity to this guy's IP address, then they ought to be sophisticated enough that they will also perform some digital forensics on his computers (not to mention, smart enough that they can probably understand vaguely what Tor does). If he's really involved in something, they will expect to find some evidence of that on his machine. If it's coming from other users, through Tor, then the evidence ought to demonstrate that.