I am using google analytics in my android app, the key is in a xml file.
And it will also be included in the apk as plain text.
If someone else were to unpack the apk, then they can use my key to send messy data to my google account, right?
How to prevent this from happening?
You cannot.
Fighting against Analytics Spam is very much like fighting against e-mail spam: It's a never ending task.
You might want to look for advices about fighting analytics spam to not pollute your statistics but you cannot prevent it from happening.