Although interesting story, it seems the main issue was that the author never sanitized their analytics in the first place and blindly relied on data that was never confirmed before. I've seen this as a quite common phenomenon. No piece of software does magic and they all require certain certain conditions to work as expected. In client JavaScript, these conditions are simply harder to grasp but they can be studied.