It is possible that many or all of those sessions are coming from analytics spammers. Spammers have realized that they can inject data into your Google Analytics without ever even visiting the site. They simply make calls directly to Google's tracking scripts reporting that they have visited your site (even though they never have).
They often do this to advertise a website in your referral reports, or event reports.
You can check for spammers by going to Audience -> Technology -> Network and clicking the link to report Hostname vs Sessions. It should always be your domains under hostname.