Worth noting that, since the Analytics ID is the publicly visible, anyone can load Google Analytics on their own site using that ID. No FBI connection required.
This is called Analytics hi-jacking and it was once (still is) a common spam technique: Create site buy-my-stuff.net, load a bunch of hijacked analytics scripts there, and then the owners of those accounts will see “but-my-stuff.net” in their analytics reports.
Edit: As commenter lmgk reminded me, you don’t even need to make a site, just use the API to make pageview calls.
You don't need to host a site. The data format to send data into Google Analytics is an open API (called the Measurement Protocol). You can just ping Google's servers directly with the appropriate payload, which include crafted URL parameters.
This is called Analytics hi-jacking and it was once (still is) a common spam technique: Create site buy-my-stuff.net, load a bunch of hijacked analytics scripts there, and then the owners of those accounts will see “but-my-stuff.net” in their analytics reports.
Edit: As commenter lmgk reminded me, you don’t even need to make a site, just use the API to make pageview calls.