Google doesn't check against the domains you defined?

I don't think so. I had a client that gave me the wrong code... He gave me his personal site Google A code and we placed it on the corporate site. He noticed a crazy spike in his traffic on his personal site. Then he dug deeper and noticed it was the wrong code...

No they don't confirm the domain (first hand experience). Found out while I was just messing around testing it.

The reason they probably don't do that is because there are TONs of sites out there that are mirrors of other sites, and many times, people want to see traffic stats for both sites at the same time. In that situation, this is more of a convenience than a downfall.

However, I think they should have an area in settings where you can choose which domains you want to allow. Though it's very easy to tell when you have inflated numbers (when you see keywords you aren't targetting), it's much more difficult to try and get rid of them.

Nice post.

If you go to Content Optimization - Web Design Parameters - Hostnames, you can see which hostnames that use your code have the most hits. The majority of my hits are for my domain, but I get about half a percent of hits from Google's and MSN's caches.

I had this exact same thing happen to me a while back. Some guy lifted my home page coding straight off the page and just changed the content he understood, but was too dense to cope with the Google scripting, so just left it there. Didn't take any time at all for it to come up when I was checking my stats. I just emailed him to say 'ok, I get that you're sad and incompetent enough to steal my code, but can you at least take out the scripts?' :)