Spammers are certainly able to have the whois data on a domain changed. It's simply a catch 22 for Google.