Let's say you have a message. Does it include the number of hops it has passed through? If no, what is stopping it from just being passed around indefinitely and never reaching an exit node? If yes, does this mean the first node it is passed to knows the originator, and if malicious would send it strait to an exit node and watch the exit nodes traffic?
The circuit path is decided in advance, before the message is created. During circuit creation, the number of nodes through which the circuit can pass is limited to 8. This limitation prevents somebody altering the Tor code - which is open-source and readily cloneable from GitHub - from increasing the number of default hops from 3 to something very large, thereby preventing congestion attacks.
Once the message is created and sent, it sticks to the route that has been decided in advance.