You can exclude the hostname sending data to your profile by setting up an exclude filter.
Alternatively, it might be better if you set up just an include filter for your own hostname to ensure you don't see anything like that in the future.
Google Analytics Filters - you might want to set up a rule/filter to "Include only traffic from the domains equal to" YourDomain.net.
and also:
How to Protect Yourself
All you need is a simple filter. It will only include traffic on your domain, protecting yourself from any data corruption when people hijack your Google Analytics Property ID.
To find your filters:
Go to your Google Analytics standard reports
Click on the “Admin” button in the top right
Click on “Filters”
Click “+ New Filter”
Then use these settings for your filter:
Select “Create New filter for Profile”
Name your filter with something snazzy like “Hacking Defense”
Select “Custom Filter”
Select “Include”
For the Filter Field, select “Hostname”
If your site is example.com, you would define the filter pattern as “example.com” and make sure to include a “\” before any “.”
Pick “No” for case-sensitive
the answers are here:
https://webmasters.stackexchange.com/questions/28994/someone-else-is-using-our-google-analytics-tracking-code-number-what-do-we-do
https://blog.kissmetrics.com/protect-analytics-from-hacking/