They can hide their nefarious links in a shortened URL meaning people either clicked on the links and quickly learned to either never trust a shortened link, or to always use a link extraction site (e.g. WhereDoesThisLinkGo) to see where the shortened link actually went before they clicked. See if you are using Classic Analytics (ga.js) or Universal Analytics (analytics.js).