Ouch. That is a pretty serious security hole on a tax website, they're using Google Analytics - google or someone who breached their security could entirely take over the tax website and record all the data.

Wouldn't it be a lot safer to handle their own analytics with a self-hosted solution rather than paying google for it? At the very least they could self-host the js so that they control what is being run on their own domain.