However I'm still interested in how to block this kind of abuse outside of tor
itself. I'm looking to implement some iptables limiting and I'm wondering how
the limits should be so that I don't deny normal tor traffic.

Would a 10 connections per IP limit be OK? Should be higher than that?