said by IamGimli:Except they don't have to prove it was you who committed the offense, only that you are responsible for it, which your ISP's ToS clearly spell out.
And the "rules" aren't "a bit more relaxed in civil court", they are completely different. Criminal responsibility must be proven beyond reasonable doubt. Civil responsibility must be proven based on a balance of probability. That means if they can prove it's more likely to have been your account than any other that was used to commit the infraction, then the judgement goes in their favour.
Just like red light cameras issue tickets to the owner of the vehicle, whether they can prove he was driving or not.
Both sides have to make the case with a strong burden on the extortionist who will have logs and hash tags etc etc.