A few dimensions I look at when hunting bot traffic are as follows. These can be viewed in various reports as well as creating segments and filters.
- Hostname
- Was your site on your server actually visited?
- Source
- Is the bot trying to spoof a campaign using a forced source/medium?
- Referral
- Is the bot attempting to get traffic back to its own site?
- Browser/Network
- Is there anything in the browser/network data that implies bot traffic?
- Geolocation
- Is the traffic coming from expected locations? If not, look into why. This would be the least granular method.
Some more specifics might be helpful to get a better tailored answer to your specific issue- like if he was sending lots of traffic, what is the common dimension behind those hits?
I made a custom report that you can find in the Gallery (Customization > Import From Gallery > Search for "Spambot Hunting"). This might help illuminate some clues for you.