those spammers don't need to visit your site to send bogus analytics data. All they need is your unique GA tracking id, and they can fire data straight into google.

this is something google should take care of, not the site owners that use GA.

that might be a problem for mobile devices.