If it shows in GA, it's possible that they just run your GA script in order to keyword-spam your dashboard. Do you get any server logs for the visits? You can

If it shows in GA, it's possible that they just run your GA script in order to keyword-spam your dashboard. Do you get any server logs for the visits? You can block IP addresses if you control the server.