I have an app that resides on a server. It has only ever accessed the API from 2 IP addresses. The API key has not been shared and there is no client-side code.
When I go to /apps however, it says "5 unique visitors."
There's a bug in there somewhere.