It's possible lots of people are quick at closing pop-up/under windows.
I think I generally am quick enough to close a pop-up before the page has loaded, which sometimes/often would mean the Google Analytics script hasn't loaded (depending on how Analytics was setup - the new async loaded at the top of the page would probably have caught me, the older syncronous one at the end of the page would probably have missed me).
My guess is that instead it was a rented botnet.
Essentially you payed to DDOS yourself.