Happened to me to, luckily only was 40$, restricted the api the next day. They were using gemini 3 flash which I am not using.

That’s users, for ya! They will always find ways to use your product that you didn’t intend to or even knew about!

The funny thing is that the website only has firebase auth, without any ai features. The default api key that was created (before the ai was even released a few years back), someone got it from the website and started using the gemini api with the key.

Protonmail is the solution, or hosting your own email server but that one is more complex.

unfortunately hosting your own email server is nearly impossible if you want reliable delivery. If you don't care about being put in the spam box then it can work.

I have my own email server, with the correct dns records it does deliver emails with no issues.

I am glad I have finally started self hosting my own git server, and stop worrying about github :-)