The funny thing is that the website only has firebase auth, without any ai features.
The default api key that was created (before the ai was even released a few years back), someone got it from the website and started using the gemini api with the key.