#6252 didn't go far enough
In #6252 (moved) we noted that a client can send sendme cells preemptively to the exit relay, thus cheating on her circuit window (and getting more than her fair share of throughput). We fixed it at the exit relay (now it checks if the window is higher than it's allowed to be), but we didn't fix it at other relays in the circuit -- so she can still send a sendme after the cells have been packaged by the exit relay, but before they've made it all the way to the client, and do a more subtle version of cheating. This one's trickier to execute, but still worth fixing because it opens up all the issues that we thought we'd closed in #6252 (moved).
Reported by Rob Jansen and Florian Tschorsch.