I wonder how easy it is. Google says they require 1000 "Active visitors." So you need to not only create 1000 fake accounts to target a single real individual, but run 1000 undetected clickfraud bots (and then pay out on your own clickfraud). Not sure of the current state of the clickfraud arms race, but maybe there are cheaper and easier ways of snooping?
I don't imagine targeting any random user is particularly efficient, but when you are dealing with multi million user databases, finding close to a thousand people who share a first or last name probably isn't hard. They don't even have to address it to a person, simply provide some details (details vary based on database). Think "How was you recent trip to Hawaii? Click here for winter deals!"
