Just speculation, but it sounds like they injected false traffic to your client’s Google Analytics making it appear as if there’s an actual page on your client’s domain. Something like this happened to my company’s site early this year. The people doing this do it to get your attention to sell their service of inflating Google Analytics numbers.