Spammers likely use the public API to send the fake traffic (https://developers.google.com/analytics/devguides/collection...). The issue Google has is they need to provide a way to authentiate the data rather than rely on the public tracker id, then at least the data could be relayed server side after the server has already filtererd out spam; it would also be less trivial to generate fake traffic reports too.

One tip is to set the main view to filter only to include your actual domain name. I notice a lot of the fake traffic is for traffic on other domains. I don't think these spammers are crafting fake data specific for your website. Much like comment spam, the same HTTP GET is executed millions of times against a list of defined tracking ids they have obtained.