those spammers don't need to visit your site to send bogus analytics data. All they need is your unique GA tracking id, and they can fire data straight into google.