This is a great question. Nostr isn't generally anonymous. Your IP can be logged whenever you communicate with a relay. So I assume as soon as someone starts putting drugs on nostr market, relays will begin getting subpoenas. 

What are the ways around this? Use a throwaway nostr identity and route all of your questionably-legal nostr activity through Tor?

Maybe we will see no-log nostr relays pop up. You would still be trusting them though, and a relay could be run by law enforcement trying to catch you. So I don't really see any way except using Tor.