I also noticed a number of items that are clearly hacking attempts,
such as SSI and SQL injection.
Unless you can confirm that these requests were issued against your webserver (and not directly at the Google Analytics tracking servers) there isn't much cause for concern here - your webserver should be dropping HTTP requests with malformed hosts like these before any SSI/SQL is evaluated.
I am wondering how exactly Google determines these hostnames, and
where exactly the attacker may have been attempting these exploits
that resulted in them being registered as hostnames in my GA profile?
Google Analytics is a data aggregation service - it does not do much parse the information passed to it (beyond GeoIP lookups on IP addresses and evaluation of user-agent strings).
Whichever Host field value is passed to the Google Analytics tracking servers (typically via the ga.js Javascript but, in the case of these requests, you can assume that the attacker is sending requests directly to the tracking servers without even visiting your site) will be stored.
It should be safe to ignore, though if this traffic shows up as a significant percentage of the traffic reported in your Google Analytics profile you may want to create an advanced segment to disregard unknown hostnames and contact Google Analytics support to see if they can't purge the bogus request data and (maybe, someday) implement some filters to address the problem of bogus and spam requests.
Does the fact that they are showing up as the hostname say anything
about the potential success of the attack?
Yes - it means that the attack was unsuccessful, otherwise the attack data would not have been stored. (Though it is likely a variety of attacks were tried - keep in mind, though, that your server wasn't the target if the attacks are focused on the Host field)
