Two things spring to mind: a debug message that spat out the IP it was listening on, or just scanning the internet and sending every server a Host header that's the Tor hostname. Sounds more like the former though.