What is to stop a malicious attacker only mining 1 transaction per block? Even without 51% of the mining power, if you have say 5% of mining power and you deliberately only mine 1 transaction in your block aren't you going to create a traffic jam of transactions and effectively DDOS the network? (And the 1 transaction could be a movement of the attackers own funds backward and forward).

Roughly 5% of blocks are going to get no useful transactions processed.
With 5% of mining power you only mine 1 every 20 blocks. "The attacker" would somewhat slow the network down, but they wouldn't stop it from working. He would need to pay for all the harware he is using and he would deliberately loose the potential 0.5 BTC per block in fees.