That’s users, for ya! They will always find ways to use your product that you didn’t intend to or even knew about!
The funny thing is that the website only has firebase auth, without any ai features.
The default api key that was created (before the ai was even released a few years back), someone got it from the website and started using the gemini api with the key.