It sounds like it's close to hurting performance for legit users. Also, since we don't know what the botnet operator's planning, it's probably safest for Tor to try to stop it.