How are they doing what they do? How could a spammer get to know Mirrorshades protocol to send a false referrer report (which is not the Referer header) in an AJAX request?
What if the analytics server actually parsed the referring page to see if there's a real link there and only confirm the referrer after that? Isn't there a third party service that checks these things?