You can trace the origin from a site back to a domain or network (probably one bouncing an IP), you can look for listed owner and simply monitor traffic, then you can backtrace to whoever is doing it (again likely using say a botnet), it takes time and a fair amount of effort.