I would assume that the NSA runs enough TOR nodes to correlate traffic from one side of the network to the other side at least a decent percentage of the time. I would also assume that they have a realtime view of the number of bytes entering or leaving any datacenter.