I've created an open source project and forgot to remove my tracking code too. The only thing was, I was hosting my own analytics with piwik, so the tracking code came from my domain. Although I marked the code with comments lots of people still left it there.

If I was a bad guy this would be an easy and subtle XSS attack vector