I have never thought about this before.. but it's possible. Only because of how Tor works, sending data through different nodes before reaching to the actuall server.. and vice-versa.
So someone could have manipulated the data transfer between the user and the server as a "middle man" of some kind.
The middle man can only be the exit node as this is when the data eventually gets decrypted and the exit node is the only node that can see the data that is being transferred from the tor network to the rest of the internet. The middle nodes and the entry guards cannot see the traffic in decrypted format