Syntax said:
You're correct in the fact that nobody can see where the request is from. The exit node can see all the information you input to the website though. Passwords, logins, emails. Shit like that. If you don't want to risk your account being stolen I would recommend a paid vpn like NORD or Express. If you aren't paying for a product then you ARE the product(Free vpns should be avoided like the plague as you said).
Unfortunately you are wrong mate. This is HTTPS encrypted, the exit node can only see an encrypted request coming from the previous node to the normal internet. It can see someone on the TOR network wants to be connected to the forums, but can't see any of the data because it's encrypted. MITM attacks are much more complicated. TOR is perfectly safe and anonymous.
While VPNs are an alternative to TOR, you are trusting a private company anyway. There's a nice website that compares all VPNs characteristics but I don't remember its name. VPN providers cannot see either what exactly you are doing within a website, but can see that YOU specifically are connected to it (as opposite to TOR where the exit node only knows someone - generic - is). It's easier to track you down using a normal VPN.
Keep safe