It's possible, however, the individuals would have to be running the spam over a browser which is parsing the GA.js script and forwarding the results on to Google Analytics.
I've never seen an implementation like that, as it just seems woefully inefficient (unless it's being run across a
FunWebProducts-style botnet).
The site in question is not a blog site, we don't publish referrer statistics anywhere, and the bounce rate for keywords with a plus delimiter is low (8.76%, with an average time on page of 00:06:39) - and Google Analytics reports revenue for the plus sign-delimited keywords.
There is no increase in referral traffic which coincides with the increase in plus sign-delimited keyword entries, however, it does appear as though the plus sign-delimited keywords are cannibalizing the space-delimited keyword volume.
I should add that this could be an issue with the handoff from the GA.js portion of the site (which covers the portion of the site which is marketed) to the shopping cart running on the urchin.js script (perhaps GA.js makes use of the plus sign delimiter in the session cookie and urchin.js is looking for a different character and then choking on it?).