People who post threats via Tor tend to get caught for being the only plausible suspect using Tor at the time of the threat.