Doesn't matter; it's the account owner who is responsible for it.

Injecting into a webpage is unacceptable.

They have a comment in the script

  // Intended use is to display browser notifications for critical and time sensitive alerts.

I imagine you can rack up a fair amount of usage before checking emails, only to find you went over your cap a few hours ago.

All the more reason to notify the bill payer, and not the current surfer/downloader.

Maybe the power company should blink account warnings in morse code through your lightbulbs. After all, it may not be the person paying the bill that is using all of the power....